--- x/drivers/android/binder.c
+++ y/drivers/android/binder.c
@@ -6252,6 +6252,7 @@ static void binder_deferred_release(stru
 		ref = rb_entry(n, struct binder_ref, rb_node_desc);
 		outgoing_refs++;
 		binder_cleanup_ref_olocked(ref);
+		binder_dequeue_work(proc, &ref->freeze->work);
 		binder_proc_unlock(proc);
 		binder_free_ref(ref);
 		binder_proc_lock(proc);