High · 7.8 CVE-2024-26926 EUVD-2024-24188GHSA-g993-hcw2-pmmf

binder: check offset alignment in binder_get_object()

Published Apr 24, 2024 · Updated Aug 5, 2026 · Assigned by Linux

Vendor: Linux Product: Linux Package: linux Package: linux Package: linux-allwinner-5.19 Package: linux-aws Package: linux-aws-5.0 Package: linux-aws-5.11 Package: linux-aws-5.13 Package: linux-aws-5.15 Package: linux-aws-5.19 Package: linux-aws-5.3 Package: linux-aws-5.4 Package: linux-aws-5.8 Package: linux-aws-6.2 Package: linux-aws-6.5 Package: linux-aws-6.8 Package: linux-aws-fips Package: linux-azure Package: linux-azure-5.11 Package: linux-azure-5.13 Package: linux-azure-5.15 Package: linux-azure-5.19 Package: linux-azure-5.3 Package: linux-azure-5.4 Package: linux-azure-5.8 Package: linux-azure-6.2 Package: linux-azure-6.5 Package: linux-azure-6.8 Package: linux-azure-edge Package: linux-azure-fde Package: linux-azure-fde-5.19 Package: linux-azure-fde-6.2 Package: linux-azure-fips Package: linux-bluefield Package: linux-fips Package: linux-gcp Package: linux-gcp-5.11 Package: linux-gcp-5.13 Package: linux-gcp-5.15 Package: linux-gcp-5.19 Package: linux-gcp-5.3 Package: linux-gcp-5.4 Package: linux-gcp-5.8 Package: linux-gcp-6.2 Package: linux-gcp-6.5 Package: linux-gcp-fips Package: linux-gke Package: linux-gke-4.15 Package: linux-gke-5.15 Package: linux-gke-5.4 Package: linux-gkeop Package: linux-gkeop-5.15 Package: linux-gkeop-5.4 Package: linux-hwe Package: linux-hwe-5.11 Package: linux-hwe-5.13 Package: linux-hwe-5.15 Package: linux-hwe-5.19 Package: linux-hwe-5.4 Package: linux-hwe-5.8 Package: linux-hwe-6.2 Package: linux-hwe-6.5 Package: linux-hwe-edge Package: linux-ibm Package: linux-ibm-5.15 Package: linux-ibm-5.4 Package: linux-intel Package: linux-intel-5.13 Package: linux-intel-iot-realtime Package: linux-intel-iotg Package: linux-intel-iotg-5.15 Package: linux-iot Package: linux-kvm Package: linux-lowlatency Package: linux-lowlatency-hwe-5.15 Package: linux-lowlatency-hwe-5.19 Package: linux-lowlatency-hwe-6.2 Package: linux-lowlatency-hwe-6.5 Package: linux-nvidia Package: linux-nvidia-6.2 Package: linux-nvidia-6.5 Package: linux-nvidia-6.8 Package: linux-nvidia-tegra Package: linux-nvidia-tegra-5.15 Package: linux-nvidia-tegra-igx Package: linux-oem Package: linux-oem-5.10 Package: linux-oem-5.13 Package: linux-oem-5.14 Package: linux-oem-5.17 Package: linux-oem-5.6 Package: linux-oem-6.0 Package: linux-oem-6.1 Package: linux-oem-6.5 Package: linux-oem-6.8 Package: linux-oracle Package: linux-oracle-5.0 Package: linux-oracle-5.11 Package: linux-oracle-5.13 Package: linux-oracle-5.15 Package: linux-oracle-5.3 Package: linux-oracle-5.4 Package: linux-oracle-5.8 Package: linux-oracle-6.5 Package: linux-oracle-6.8 Package: linux-raspi Package: linux-raspi-5.4 Package: linux-raspi-realtime Package: linux-raspi2 Package: linux-realtime Package: linux-riscv Package: linux-riscv-5.11 Package: linux-riscv-5.15 Package: linux-riscv-5.19 Package: linux-riscv-5.8 Package: linux-riscv-6.5 Package: linux-starfive-5.19 Package: linux-starfive-6.2 Package: linux-starfive-6.5 Package: linux-vmware Package: linux-xilinx-zynqmp Platform: Linux Ecosystem: Debian Ecosystem: Ubuntu

Description

In the Linux kernel, the following vulnerability has been resolved:

binder: check offset alignment in binder_get_object()

Commit 6d98eb95b450 ("binder: avoid potential data leakage when copying
txn") introduced changes to how binder objects are copied. In doing so,
it unintentionally removed an offset alignment check done through calls
to binder_alloc_copy_from_buffer() -> check_buffer().

These calls were replaced in binder_get_object() with copy_from_user(),
so now an explicit offset alignment check is needed here. This avoids
later complications when unwinding the objects gets harder.

It is worth noting this check existed prior to commit 7a67a39320df
("binder: add function to copy binder object from buffer"), likely
removed due to redundancy at the time.

Affected products

Vendor	Product	Affected	Fixed
Linux	Linux	5.4.226 – < 5.4.275, 5.10.157 – < 5.10.216, 5.15.17 – < 5.15.157, 5.16.3 – < 5.17, 5.17	5.4.275

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 14	linux	6.8.9-1	—
Debian 13	linux	6.8.9-1	—
Debian 12	linux	6.1.90-1	DSA-5680-1
Debian 11	linux	5.10.216-1	DSA-5681-1
Debian 10	linux-5.10	5.10.216-1~deb10u1	DLA-3842-1

Ubuntu

Security tracker ↗

Release	Package	Fixed in	Advisory
Ubuntu Nvidia-BlueField 22.04 LTS	linux-bluefield	5.15.0-1047.49	—
Ubuntu 24.04 LTS	linux	6.8.0-38.38	USN-6893-1
Ubuntu 24.04 LTS	linux-aws	6.8.0-1011.12	USN-6893-3
Ubuntu 24.04 LTS	linux-azure	6.8.0-1010.10	USN-6893-1
Ubuntu 24.04 LTS	linux-gcp	6.8.0-1010.11	USN-6893-1
Ubuntu 24.04 LTS	linux-gke	6.8.0-1006.9	USN-6893-2
Ubuntu 24.04 LTS	linux-ibm +2	6.8.0-1008.8	USN-6918-1, USN-6893-1
Ubuntu 24.04 LTS	linux-intel	6.8.0-1007.14	USN-6893-1
Ubuntu 24.04 LTS	linux-nvidia	6.8.0-1009.9	USN-6893-2
Ubuntu 24.04 LTS	linux-raspi	6.8.0-1007.7	USN-6893-1
Ubuntu 24.04 LTS	linux-riscv +1	6.8.0-38.38.1	USN-6893-1
Ubuntu 22.04 LTS	linux +1	5.15.0-116.126	USN-6898-2, USN-6898-1
Ubuntu 22.04 LTS	linux-aws	5.15.0-1065.71	USN-6898-3
Ubuntu 22.04 LTS	linux-aws-6.5	6.5.0-1023.23~22.04.1	USN-6895-3
Ubuntu 22.04 LTS	linux-aws-6.8	6.8.0-1011.12~22.04.1	—
Ubuntu 22.04 LTS	linux-azure	5.15.0-1068.77	USN-6917-1
Ubuntu 22.04 LTS	linux-azure-6.5	6.5.0-1024.25~22.04.1	USN-6895-2
Ubuntu 22.04 LTS	linux-azure-6.8	6.8.0-1010.10~22.04.1	—
Ubuntu 22.04 LTS	linux-azure-fde	5.15.0-1068.77.1	USN-6917-1
Ubuntu 22.04 LTS	linux-gcp	5.15.0-1064.72	USN-6898-1
Ubuntu 22.04 LTS	linux-gcp-6.5	6.5.0-1024.26~22.04.1	USN-6895-2
Ubuntu 22.04 LTS	linux-gke	5.15.0-1062.68	USN-6898-1
Ubuntu 22.04 LTS	linux-gkeop	5.15.0-1048.55	USN-6898-1
Ubuntu 22.04 LTS	linux-hwe-6.5	6.5.0-44.44~22.04.1	USN-6900-1
Ubuntu 22.04 LTS	linux-ibm +1	5.15.0-1058.61	USN-6919-1, USN-6898-1
Ubuntu 22.04 LTS	linux-intel-iotg	5.15.0-1060.66	USN-6898-1
Ubuntu 22.04 LTS	linux-kvm	5.15.0-1062.67	USN-6898-1
Ubuntu 22.04 LTS	linux-lowlatency-hwe-6.5	6.5.0-44.44.1~22.04.1	USN-6895-3
Ubuntu 22.04 LTS	linux-nvidia	5.15.0-1060.61	USN-6898-1
Ubuntu 22.04 LTS	linux-nvidia-6.5	6.5.0-1023.24	USN-6895-1
Ubuntu 22.04 LTS	linux-nvidia-6.8	6.8.0-1009.9~22.04.1	—
Ubuntu 22.04 LTS	linux-nvidia-tegra	5.15.0-1026.26	—
Ubuntu 22.04 LTS	linux-nvidia-tegra-igx	5.15.0-1015.15	—
Ubuntu 22.04 LTS	linux-oem-6.5	6.5.0-1027.28	USN-6895-4
Ubuntu 22.04 LTS	linux-oracle	5.15.0-1063.69	USN-6898-1
Ubuntu 22.04 LTS	linux-oracle-6.5	6.5.0-1026.26~22.04.1	USN-6895-3
Ubuntu 22.04 LTS	linux-oracle-6.8	6.8.0-1008.8~22.04.1	—
Ubuntu 22.04 LTS	linux-riscv +22	No fix yet	—
Ubuntu 22.04 LTS	linux-starfive-6.5	6.5.0-1017.18~22.04.1	USN-6895-3
Ubuntu 22.04 LTS	linux-xilinx-zynqmp	5.15.0-1035.39	USN-7019-1
Ubuntu 20.04 LTS	linux	5.4.0-189.209	USN-6896-1
Ubuntu 20.04 LTS	linux-aws	5.4.0-1128.138	USN-6896-5
Ubuntu 20.04 LTS	linux-aws-5.15	5.15.0-1065.71~20.04.1	USN-6898-4
Ubuntu 20.04 LTS	linux-azure	5.4.0-1133.140	USN-6896-1
Ubuntu 20.04 LTS	linux-azure-5.15	5.15.0-1068.77~20.04.1	USN-6917-1
Ubuntu 20.04 LTS	linux-azure-fde-5.15	5.15.0-1068.77~20.04.1.1	USN-6917-1
Ubuntu 20.04 LTS	linux-bluefield	5.4.0-1088.95	USN-6896-1
Ubuntu 20.04 LTS	linux-gcp	5.4.0-1132.141	USN-6896-1
Ubuntu 20.04 LTS	linux-gcp-5.15	5.15.0-1065.73~20.04.1	USN-6927-1
Ubuntu 20.04 LTS	linux-gke +26	No fix yet	—
Ubuntu 20.04 LTS	linux-gkeop	5.4.0-1095.99	USN-6896-1
Ubuntu 20.04 LTS	linux-gkeop-5.15	5.15.0-1048.55~20.04.1	USN-6898-1
Ubuntu 20.04 LTS	linux-hwe-5.15 +1	5.15.0-116.126~20.04.1	USN-6898-3, USN-6898-2
Ubuntu 20.04 LTS	linux-ibm	5.4.0-1075.80	USN-6896-1
Ubuntu 20.04 LTS	linux-ibm-5.15	5.15.0-1058.61~20.04.1	USN-6898-2
Ubuntu 20.04 LTS	linux-intel-iotg-5.15	5.15.0-1060.66~20.04.1	USN-6898-1
Ubuntu 20.04 LTS	linux-iot	5.4.0-1040.41	USN-6896-5
Ubuntu 20.04 LTS	linux-kvm	5.4.0-1116.123	USN-6896-1
Ubuntu 20.04 LTS	linux-nvidia-tegra-5.15	5.15.0-1027.27~20.04.1	—
Ubuntu 20.04 LTS	linux-oracle	5.4.0-1127.136	USN-6896-3
Ubuntu 20.04 LTS	linux-oracle-5.15	5.15.0-1063.69~20.04.1	USN-6898-2
Ubuntu 20.04 LTS	linux-raspi	5.4.0-1112.124	USN-6896-4
Ubuntu 20.04 LTS	linux-riscv-5.15	5.15.0-1061.65~20.04.1	—
Ubuntu 20.04 LTS	linux-xilinx-zynqmp	5.4.0-1047.51	USN-6896-3
Ubuntu 18.04 LTS	linux-gcp +13	No fix yet	—

Show 7 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
Ubuntu 16.04 LTS	linux-hwe-edge	No fix yet	—
Ubuntu Pro Realtime 24.04 LTS	linux-raspi-realtime	6.8.0-2006.6	—
Ubuntu Pro Realtime 24.04 LTS	linux-realtime	6.8.1-1004.4	—
Ubuntu Pro Realtime 22.04 LTS	linux-intel-iot-realtime	5.15.0-1058.60	—
Ubuntu Pro Realtime 22.04 LTS	linux-realtime	5.15.0-1066.74	—
Ubuntu Pro FIPS-updates 22.04 LTS	linux-aws-fips	5.15.0-1065.71+fips1	—
Ubuntu Pro FIPS-updates 22.04 LTS	linux-azure-fips	5.15.0-1068.77+fips1	—
Ubuntu Pro FIPS-updates 22.04 LTS	linux-fips	5.15.0-115.125+fips1	—
Ubuntu Pro FIPS-updates 22.04 LTS	linux-gcp-fips	5.15.0-1064.72+fips1	—
Ubuntu Pro FIPS-updates 20.04 LTS	linux-aws-fips	5.4.0-1128.138+fips1	—
Ubuntu Pro FIPS-updates 20.04 LTS	linux-azure-fips	5.4.0-1133.140+fips1	—
Ubuntu Pro FIPS-updates 20.04 LTS	linux-fips	5.4.0-1102.112	—
Ubuntu Pro FIPS-updates 20.04 LTS	linux-gcp-fips	5.4.0-1132.141+fips1	—
Ubuntu Pro FIPS-preview 22.04 LTS	linux-fips +3	No fix yet	—
Ubuntu Pro 18.04 LTS	linux-aws-5.4	5.4.0-1128.138~18.04.1	USN-6896-5
Ubuntu Pro 18.04 LTS	linux-azure-5.4	5.4.0-1133.140~18.04.1	USN-6896-1
Ubuntu Pro 18.04 LTS	linux-gcp-5.4	5.4.0-1132.141~18.04.1	USN-6896-1
Ubuntu Pro 18.04 LTS	linux-hwe-5.4	5.4.0-189.209~18.04.1	USN-6896-2
Ubuntu Pro 18.04 LTS	linux-ibm-5.4	5.4.0-1075.80~18.04.1	USN-6896-1
Ubuntu Pro 18.04 LTS	linux-oracle-5.4	5.4.0-1127.136~18.04.1	USN-6896-2
Ubuntu Pro 18.04 LTS	linux-raspi-5.4	5.4.0-1112.124~18.04.1	USN-6896-4

Advisories 30

USN-6896-1 linux, linux-azure, linux-azure-5.4, linux-bluefield, linux-gcp, linux-gcp-5.4, linux-gkeop, linux-ibm, linux-ibm-5.4, linux-kvm vulnerabilities Ubuntu Security Notices (USN) · Oct 27, 2026
USN-6919-1 linux-raspi vulnerabilities Ubuntu Security Notices (USN) · Oct 27, 2026
USN-6896-5 linux-aws, linux-aws-5.4, linux-iot vulnerabilities Ubuntu Security Notices (USN) · Oct 27, 2026
USN-6896-3 linux-oracle, linux-xilinx-zynqmp vulnerabilities Ubuntu Security Notices (USN) · Oct 27, 2026
USN-6896-4 linux-raspi, linux-raspi-5.4 vulnerabilities Ubuntu Security Notices (USN) · Oct 27, 2026
USN-6896-2 linux-hwe-5.4, linux-oracle-5.4 vulnerabilities Ubuntu Security Notices (USN) · Oct 27, 2026
USN-7019-1 linux-xilinx-zynqmp vulnerabilities Ubuntu Security Notices (USN) · Oct 26, 2026
USN-6917-1 linux-azure, linux-azure-5.15, linux-azure-fde, linux-azure-fde-5.15 vulnerabilities Ubuntu Security Notices (USN) · Oct 26, 2026
USN-6927-1 linux-gcp-5.15 vulnerabilities Ubuntu Security Notices (USN) · Oct 26, 2026
USN-6898-1 linux, linux-gcp, linux-gke, linux-gkeop, linux-gkeop-5.15, linux-ibm, linux-intel-iotg, linux-intel-iotg-5.15, linux-kvm, linux-nvidia, linux-oracle vulnerabilities Ubuntu Security Notices (USN) · Oct 23, 2026
USN-6893-1 linux, linux-azure, linux-gcp, linux-ibm, linux-intel, linux-lowlatency, linux-oem-6.8, linux-raspi vulnerabilities Ubuntu Security Notices (USN) · Oct 23, 2026
USN-6898-2 linux-ibm-5.15, linux-lowlatency, linux-lowlatency-hwe-5.15, linux-oracle-5.15 vulnerabilities Ubuntu Security Notices (USN) · Oct 23, 2026
USN-6895-3 linux-aws-6.5, linux-lowlatency-hwe-6.5, linux-oracle-6.5, linux-starfive-6.5 vulnerabilities Ubuntu Security Notices (USN) · Oct 23, 2026
USN-6900-1 linux-hwe-6.5 vulnerabilities Ubuntu Security Notices (USN) · Oct 23, 2026
USN-6895-2 linux-azure-6.5, linux-gcp-6.5 vulnerabilities Ubuntu Security Notices (USN) · Oct 23, 2026
USN-6898-3 linux-aws, linux-hwe-5.15 vulnerabilities Ubuntu Security Notices (USN) · Oct 23, 2026
USN-6898-4 linux-aws-5.15 vulnerabilities Ubuntu Security Notices (USN) · Oct 23, 2026
USN-6893-2 linux-gke, linux-nvidia vulnerabilities Ubuntu Security Notices (USN) · Oct 23, 2026
USN-6893-3 linux-aws vulnerabilities Ubuntu Security Notices (USN) · Oct 23, 2026
USN-6918-1 linux-oracle vulnerabilities Ubuntu Security Notices (USN) · Oct 23, 2026
USN-6895-1 linux, linux-gcp, linux-nvidia-6.5, linux-raspi vulnerabilities Ubuntu Security Notices (USN) · Oct 23, 2026
USN-6895-4 linux-oem-6.5 vulnerabilities Ubuntu Security Notices (USN) · Oct 23, 2026
DSA-5680-1 linux - security update Debian Security (DSA / DLA) · Mar 9, 2026
DSA-5681-1 linux - security update Debian Security (DSA / DLA) · Mar 9, 2026
DLA-3842-1 linux-5.10 - security update Debian Security (DSA / DLA) · Mar 9, 2026
WID-SEC-2024-1278 Android Patchday - June 2024: Mehrere Schwachstellen BSI CERT-Bund (WID) · Mar 2, 2026
ICSA-25-226-15 Siemens SINEC OS CISA ICS & IT advisories · Feb 25, 2026
SSA-613116 SSA-613116: Multiple Vulnerabilities in Third-Party Components in SINEC OS before V3.1 Siemens ProductCERT · Feb 24, 2026
WID-SEC-2024-0964 Linux Kernel: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff BSI CERT-Bund (WID) · Feb 16, 2026
NCSC-2024-0240 Kwetsbaarheden verholpen in Google Android en Samsung Mobile NCSC-NL (Netherlands) · Jun 7, 2024

References