PT-2026-64688 · Linux · Linux
CVE-2026-64467
·
Published
2026-07-25
·
Updated
2026-07-25
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
In the Linux kernel, the following vulnerability has been resolved:
rust binder: use a u64 stride when cleaning up the offsets array
Allocation's Drop walks the offsets array (binder size t = u64 entries),
cleaning up the objects, but it used usize instead of u64 for both the
stride and the per-entry read.
On 64-bit kernels (usize == u64) this is harmless, but on 32-bit kernels
it walks the 8-byte entries in 4-byte steps, iterating an N-entry array
2N times, and reads the always-zero high word as offset 0, cleaning up
the object at offset 0 N extra times. As a result the referenced node or
handle ends up with a lower reference count than it actually has (a
refcount over-decrement), and binder's reference accounting is corrupted;
for example, the owner can be notified of a strong reference release
(BR RELEASE) even though references still remain.
Change the stride to u64, and read each entry as a u64, narrowing it to
usize with try into().
On 32-bit ARM, when this over-decrement would drive a count below zero,
the driver's existing refcount guard refuses it and fires:
rust binder: Failure: refcount underflow!
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linux