CVE-2026-64467

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

rust_binder: use a u64 stride when cleaning up the offsets array

Allocation's Drop walks the offsets array (binder_size_t = u64 entries),

cleaning up the objects, but it used usize instead of u64 for both the

stride and the per-entry read.

On 64-bit kernels (usize == u64) this is harmless, but on 32-bit kernels

it walks the 8-byte entries in 4-byte steps, iterating an N-entry array

2N times, and reads the always-zero high word as offset 0, cleaning up

the object at offset 0 N extra times. As a result the referenced node or

handle ends up with a lower reference count than it actually has (a

refcount over-decrement), and binder's reference accounting is corrupted;

for example, the owner can be notified of a strong reference release

(BR_RELEASE) even though references still remain.

Change the stride to u64, and read each entry as a u64, narrowing it to

usize with try_into().

On 32-bit ARM, when this over-decrement wo

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References