CVE-2026-98776

A race in binderfs device creation can cause a use-after-free write because simple_done_creating() releases the parent directory lock and the creator dentry reference before binder_add_device() registers the device. A concurrent unlinkat() can remove the new entry and trigger binderfs_evict_inode(), freeing the device before hlist_add_head writes list pointers into it. The demonstrated primitive is an 8 byte write into a freed kmalloc-512 object rather than a NULL pointer dereference or a warning only condition. For the CVSS the PR:L reflects that a local process needs access to the binderfs control interface and permission to create and unlink binderfs device entries, but full host administrator privileges may not be required when binderfs is delegated to a container or service. AC:H applies because reliable triggering requires winning a race window. The issue is not network reachable. Impact is at least a local denial of service through kernel memory corruption and a crash. In the worst still defensible case, allocator reuse could turn the stale list write into corruption of a replacement kernel object and potentially allow privilege escalation.