---
id: CVE-2026-99075
title: 'rust_binder: reschedule node refcount update on thread exit'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  rust_binder: reschedule node refcount update on thread exit

  When a thread exits via BINDER_THREAD_EXIT, its pending work items are
  cancelled. If a thread exits while h…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= eafedbc7c050c44744fbdf80bdf3315e860b7513 <
    71cbad138969edecef01b28dff87d91b56db538d
  - >-
    Linux >= eafedbc7c050c44744fbdf80bdf3315e860b7513 <
    fb0f8dfc5a030ed3d60a1d03acdc99c90ee99fc1
  - >-
    Linux >= eafedbc7c050c44744fbdf80bdf3315e860b7513 <
    2a74ccd1bcc170e66525f34e9de8652b57e2cf3d
  - Linux 6.18
published: '2026-10-23'
updated: '2026-10-23'
sourceUpdated: '2026-10-23T12:23:18.830Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-99075'
references:
  - url: 'https://git.kernel.org/stable/c/71cbad138969edecef01b28dff87d91b56db538d'
  - url: 'https://git.kernel.org/stable/c/fb0f8dfc5a030ed3d60a1d03acdc99c90ee99fc1'
  - url: 'https://git.kernel.org/stable/c/2a74ccd1bcc170e66525f34e9de8652b57e2cf3d'
tags:
  - cve.org
ingestedAt: '2026-10-23T13:24:55.514Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

rust_binder: reschedule node refcount update on thread exit

When a thread exits via BINDER_THREAD_EXIT, its pending work items are
cancelled. If a thread exits while holding a pending node refcount
increment (e.g. pushed as deferred work to that thread), the refcount
increment was previously dropped because Node::cancel() and
NodeWrapper::cancel() were no-ops.

Dropping the refcount update leaves the node's delivery state and count
state desynchronized, and userspace will not receive the notification,
which can cause the node to never be freed from the process's nodes tree
when all external references are dropped.

Fix this by implementing DeliverToRead::cancel() for Node and NodeWrapper
to move the pending refcount update to the process's work queue on thread
exit so another thread can deliver it to userspace.

## Affected

- `Linux >= eafedbc7c050c44744fbdf80bdf3315e860b7513 < 71cbad138969edecef01b28dff87d91b56db538d`
- `Linux >= eafedbc7c050c44744fbdf80bdf3315e860b7513 < fb0f8dfc5a030ed3d60a1d03acdc99c90ee99fc1`
- `Linux >= eafedbc7c050c44744fbdf80bdf3315e860b7513 < 2a74ccd1bcc170e66525f34e9de8652b57e2cf3d`
- `Linux 6.18`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.