CVE-2026-98778

In the Linux kernel, the following vulnerability has been resolved:

binder: fix is_failure flag for superseded transaction cleanup

When a TF_UPDATE_TXN transaction supersedes a pending async transaction,

binder_release_entire_buffer() is called with is_failure=false. Since the

superseded transaction was never delivered, binder_apply_fd_fixups() was

never called and no fds were installed in the target process.

With is_failure=false, the BINDER_TYPE_FDA cleanup handler interprets

stale buffer contents as installed fd numbers and passes them to

binder_deferred_fd_close(), closing unrelated file descriptors.

Pass is_failure=true since the transaction was never delivered to the

target, matching the semantics of all other undelivered-transaction

cleanup paths.