In the Linux kernel, the following vulnerability has been resolved: binder: fix UAF of ref->proc caused by race condition A transaction of type BINDER_TYPE_WEAK_HANDLE can fail to increment the reference for a node. In this case, the target proc normally releases the failed reference upon close as expected. However, if the target is dying in parallel the call will race with binder_deferred_release(), so the target could have released all of its references by now leaving the cleanup of the new failed reference unhandled. The transaction then ends and the target proc gets released making the ref->proc now a dangling pointer. Later on, ref->node is closed and we attempt to take spin_lock(&ref->proc->inner_lock), which leads to the use-after-free bug reported below. Let's fix this by cleaning up the failed reference on the spot instead of relying on the target to do so. ================================================================== BUG: KASAN: use-after-free in _raw_spin_lock+0xa8/0x150 Write of size 4 at addr ffff5ca207094238 by task kworker/1:0/590 CPU: 1 PID: 590 Comm: kworker/1:0 Not tainted 5.19.0-rc8 #10 Hardware name: linux,dummy-virt (DT) Workqueue: events binder_deferred_func Call trace: dump_backtrace.part.0+0x1d0/0x1e0 show_stack+0x18/0x70 dump_stack_lvl+0x68/0x84 print_report+0x2e4/0x61c kasan_report+0xa4/0x110 kasan_check_range+0xfc/0x1a4 __kasan_check_write+0x3c/0x50 _raw_spin_lock+0xa8/0x150 binder_deferred_func+0x5e0/0x9b0 process_one_work+0x38c/0x5f0 worker_thread+0x9c/0x694 kthread+0x188/0x190 ret_from_fork+0x10/0x20

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-993199 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    binder: fix UAF of ref->proc caused by race condition

    A transaction of type BINDER_TYPE_WEAK_HANDLE can fail to increment the     reference for a node. In this case, the target proc normally releases     the failed reference upon close as expected. However, if the target is     dying in parallel the call will race with binder_deferred_release(), so     the target could have released all of its references by now leaving the     cleanup of the new failed reference unhandled.

    The transaction then ends and the target proc gets released making the     ref->proc now a dangling pointer. Later on, ref->node is closed and we     attempt to take spin_lock(&ref->proc->inner_lock), which leads to the     use-after-free bug reported below. Let's fix this by cleaning up the     failed reference on the spot instead of relying on the target to do so.

      ==================================================================       BUG: KASAN: use-after-free in _raw_spin_lock+0xa8/0x150       Write of size 4 at addr ffff5ca207094238 by task kworker/1:0/590

      CPU: 1 PID: 590 Comm: kworker/1:0 Not tainted 5.19.0-rc8 #10       Hardware name: linux,dummy-virt (DT)       Workqueue: events binder_deferred_func       Call trace:
       dump_backtrace.part.0+0x1d0/0x1e0        show_stack+0x18/0x70        dump_stack_lvl+0x68/0x84        print_report+0x2e4/0x61c        kasan_report+0xa4/0x110        kasan_check_range+0xfc/0x1a4
       __kasan_check_write+0x3c/0x50
       _raw_spin_lock+0xa8/0x150        binder_deferred_func+0x5e0/0x9b0        process_one_work+0x38c/0x5f0        worker_thread+0x9c/0x694        kthread+0x188/0x190        ret_from_fork+0x10/0x20

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-992622 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    binder: fix UAF of ref->proc caused by race condition

    A transaction of type BINDER_TYPE_WEAK_HANDLE can fail to increment the     reference for a node. In this case, the target proc normally releases     the failed reference upon close as expected. However, if the target is     dying in parallel the call will race with binder_deferred_release(), so     the target could have released all of its references by now leaving the     cleanup of the new failed reference unhandled.

    The transaction then ends and the target proc gets released making the     ref->proc now a dangling pointer. Later on, ref->node is closed and we     attempt to take spin_lock(&ref->proc->inner_lock), which leads to the     use-after-free bug reported below. Let's fix this by cleaning up the     failed reference on the spot instead of relying on the target to do so.

      ==================================================================       BUG: KASAN: use-after-free in _raw_spin_lock+0xa8/0x150       Write of size 4 at addr ffff5ca207094238 by task kworker/1:0/590

      CPU: 1 PID: 590 Comm: kworker/1:0 Not tainted 5.19.0-rc8 #10       Hardware name: linux,dummy-virt (DT)       Workqueue: events binder_deferred_func       Call trace:
       dump_backtrace.part.0+0x1d0/0x1e0        show_stack+0x18/0x70        dump_stack_lvl+0x68/0x84        print_report+0x2e4/0x61c        kasan_report+0xa4/0x110        kasan_check_range+0xfc/0x1a4
       __kasan_check_write+0x3c/0x50
       _raw_spin_lock+0xa8/0x150        binder_deferred_func+0x5e0/0x9b0        process_one_work+0x38c/0x5f0        worker_thread+0x9c/0x694        kthread+0x188/0x190        ret_from_fork+0x10/0x20

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-991165 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    binder: fix UAF of ref->proc caused by race condition

    A transaction of type BINDER_TYPE_WEAK_HANDLE can fail to increment the     reference for a node. In this case, the target proc normally releases     the failed reference upon close as expected. However, if the target is     dying in parallel the call will race with binder_deferred_release(), so     the target could have released all of its references by now leaving the     cleanup of the new failed reference unhandled.

    The transaction then ends and the target proc gets released making the     ref->proc now a dangling pointer. Later on, ref->node is closed and we     attempt to take spin_lock(&ref->proc->inner_lock), which leads to the     use-after-free bug reported below. Let's fix this by cleaning up the     failed reference on the spot instead of relying on the target to do so.

      ==================================================================       BUG: KASAN: use-after-free in _raw_spin_lock+0xa8/0x150       Write of size 4 at addr ffff5ca207094238 by task kworker/1:0/590

      CPU: 1 PID: 590 Comm: kworker/1:0 Not tainted 5.19.0-rc8 #10       Hardware name: linux,dummy-virt (DT)       Workqueue: events binder_deferred_func       Call trace:
       dump_backtrace.part.0+0x1d0/0x1e0        show_stack+0x18/0x70        dump_stack_lvl+0x68/0x84        print_report+0x2e4/0x61c        kasan_report+0xa4/0x110        kasan_check_range+0xfc/0x1a4
       __kasan_check_write+0x3c/0x50
       _raw_spin_lock+0xa8/0x150        binder_deferred_func+0x5e0/0x9b0        process_one_work+0x38c/0x5f0        worker_thread+0x9c/0x694        kthread+0x188/0x190        ret_from_fork+0x10/0x20

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - binder: fix UAF of ref->proc caused by race condition A transaction of type BINDER_TYPE_WEAK_HANDLE can     fail to increment the reference for a node. In this case, the target proc normally releases the failed     reference upon close as expected. However, if the target is dying in parallel the call will race with     binder_deferred_release(), so the target could have released all of its references by now leaving the     cleanup of the new failed reference unhandled. The transaction then ends and the target proc gets released     making the ref->proc now a dangling pointer. Later on, ref->node is closed and we attempt to take     spin_lock(&ref->proc->inner_lock), which leads to the use-after-free bug reported below. Let's fix this by     cleaning up the failed reference on the spot instead of relying on the target to do so.
    ================================================================== BUG: KASAN: use-after-free in
    _raw_spin_lock+0xa8/0x150 Write of size 4 at addr ffff5ca207094238 by task kworker/1:0/590 CPU: 1 PID: 590     Comm: kworker/1:0 Not tainted 5.19.0-rc8 #10 Hardware name: linux,dummy-virt (DT) Workqueue: events     binder_deferred_func Call trace: dump_backtrace.part.0+0x1d0/0x1e0 show_stack+0x18/0x70     dump_stack_lvl+0x68/0x84 print_report+0x2e4/0x61c kasan_report+0xa4/0x110 kasan_check_range+0xfc/0x1a4
    __kasan_check_write+0x3c/0x50 _raw_spin_lock+0xa8/0x150 binder_deferred_func+0x5e0/0x9b0     process_one_work+0x38c/0x5f0 worker_thread+0x9c/0x694 kthread+0x188/0x190 ret_from_fork+0x10/0x20     (CVE-2022-49939)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
281005	Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2025-993199)	Nessus	Unity Linux Local Security Checks	high
280155	Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2025-992622)	Nessus	Unity Linux Local Security Checks	high
278274	Unity Linux 20.1050e Security Update: kernel (UTSA-2025-991165)	Nessus	Unity Linux Local Security Checks	high
246997	Linux Distros Unpatched Vulnerability : CVE-2022-49939	Nessus	Misc.	high

Detections

Analytics

CVE-2022-49939

high

Tenable Plugins

high

high

high

high