This bug report describes two different issues in different branches of the binder kernel code. The first issue is in the upstream Linux kernel, commit 7f3dc0088b98 (“binder: fix proc->files use-after-free”); the second issue is in the wahoo kernel (and maybe elsewhere? but at least the android common kernel for 4.4 doesn’t seem to contain this code...), commit 1b652c7c29b7 (“FROMLIST: binder: fix proc->files use-after-free”). In the Linux kernel, normally, when a struct file * is read from the file descriptor table, the reference counter of the struct file is bumped to account for the extra reference; this happens in fget(). Later, if the extra reference is not needed anymore, the refcount is dropped via fput(). A negative effect of this is that, if the struct file is frequently accessed, the cacheline containing the reference count is constantly dirty; and if the struct file is used by multiple tasks in parallel, cache line bouncing occurs. Linux provides the helpers fdget() and fdput() to avoid this overhead. fdget() checks whether the reference count of the file descriptor table is 1, implying that the current task has sole ownership of the file descriptor table and no concurrent modifications of the file descriptor table can occur. If this check succeeds, fdget() then omits the reference count increment on the struct file. fdget() sets a flag in its return value that signals to fdput() whether a reference count has been taken. If so, fdput() uses the normal fput() logic; if not, fdput() does nothing.