Login Sign Up

CVE-2026-23184

N/A Unknown

📋 TL;DR

This is a use-after-free vulnerability in the Linux kernel's binder IPC subsystem. It allows local attackers to potentially crash the kernel or execute arbitrary code by exploiting race conditions in frozen transaction handling. Only Linux systems using the binder subsystem are affected.

💻 Affected Systems

Products:
  • Linux kernel
Versions: Versions containing the vulnerable binder_netlink_report() code prior to fixes in commits 5e8a3d01544282e50d887d76f30d1496a0a53562 and a6050dedb6f1cc23e518e3a132ab74a0aad6df90
Operating Systems: Linux distributions using affected kernel versions
Default Config Vulnerable: ⚠️ Yes
Notes: Only affects systems with binder subsystem enabled (common in Android-based systems and some Linux distributions)

⚠️ Manual Verification Required

This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.

Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).

🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.

Recommended Actions:
  1. Review the CVE details at NVD
  2. Check vendor security advisories for your specific version
  3. Test if the vulnerability is exploitable in your environment
  4. Consider updating to the latest version as a precaution

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel panic, system crash, or potential privilege escalation to kernel-level code execution.

🟠

Likely Case

Kernel crash leading to denial of service or system instability.

🟢

If Mitigated

Limited to denial of service if exploit fails or system has additional protections.

🌐 Internet-Facing: LOW - Requires local access to exploit.
🏢 Internal Only: MEDIUM - Local users or compromised applications could exploit this vulnerability.

🎯 Exploit Status

Public PoC: ✅ No
Weaponized: UNKNOWN
Unauthenticated Exploit: ✅ No
Complexity: MEDIUM

Exploitation requires local access and knowledge of binder IPC mechanisms. Race condition exploitation adds complexity.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Linux kernel with commits 5e8a3d01544282e50d887d76f30d1496a0a53562 and a6050dedb6f1cc23e518e3a132ab74a0aad6df90 applied

Vendor Advisory: https://git.kernel.org/stable/c/5e8a3d01544282e50d887d76f30d1496a0a53562

Restart Required: Yes

Instructions:

1. Update Linux kernel to version containing the fix commits. 2. Reboot system to load new kernel. 3. Verify kernel version after reboot.

🔧 Temporary Workarounds

Disable binder subsystem

Linux

Remove binder module if not required for system functionality

rmmod binder
echo 'blacklist binder' >> /etc/modprobe.d/blacklist.conf

🧯 If You Can't Patch

  • Restrict local user access to systems
  • Implement strict SELinux/apparmor policies to limit binder access

🔍 How to Verify

Check if Vulnerable:

Check kernel version and verify if binder subsystem is present and active

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version includes the fix commits and test binder functionality

📡 Detection & Monitoring

Log Indicators:

  • Kernel panic logs
  • KASAN reports mentioning binder_netlink_report
  • System crash dumps

Network Indicators:

  • None - local vulnerability only

SIEM Query:

kernel: *KASAN* AND *binder_netlink_report* OR kernel: *panic* AND *binder*

📊 Metadata

CVE ID: CVE-2026-23184
CVSS v3 Score: N/A (Unknown)
Published: February 14, 2026
Last Updated: February 18, 2026

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON