CVE-2026-64467

Status: UPDATED  |  Advisory ID: CVE-2026-64467

Key Details

Affected Products, Subsystems & Sectors

What to Know

In the Linux kernel, the following vulnerability has been resolved:

rust_binder: use a u64 stride when cleaning up the offsets array

Allocation's Drop walks the offsets array (binder_size_t = u64 entries),

cleaning up the objects, but it used usize instead of u64 for both the

stride and the per-entry read.

On 64-bit kernels (usize == u64) this is harmless, but on 32-bit kernels

it walks the 8-byte entries in 4-byte steps, iterating an N-entry array

2N times, and reads the always-zero high word as offset 0, cleaning up

the object at offset 0 N extra times. As a result the referenced node or

handle ends up with a lower reference count than it actually has (a

refcount over-decrement), and binder's reference accounting is corrupted;

for example, the owner can be notified of a strong reference release

(BR_RELEASE) even though references still remain.

Change the stride to u64, and read each entry as a u64, narrowing it to

usize with try_into().

On 32-bit ARM, when this over-decrement would drive a count below zero,

the driver's existing refcount guard refuses it and fires:

rust_binder: Failure: refcount underflow! (NVD)

What to Do

Monitor Linux's web page for any future patch releases.

References