In the Linux kernel, the following vulnerability has been resolved:
rust_binder: use a u64 stride when cleaning up the offsets array
Allocation's Drop walks the offsets array (binder_size_t = u64 entries),
cleaning up the objects, but it used usize instead of u64 for both the
stride and the per-entry read.
On 64-bit kernels (usize == u64) this is harmless, but on 32-bit kernels
it walks the 8-byte entries in 4-byte steps, iterating an N-entry array
2N times, and reads the always-zero high word as offset 0, cleaning up
the object at offset 0 N extra times. As a result the referenced node or
handle ends up with a lower reference count than it actually has (a
refcount over-decrement), and binder's reference accounting is corrupted;
for example, the owner can be notified of a strong reference release
(BR_RELEASE) even though references still remain.
Change the stride to u64, and read each entry as a u64, narrowing it to
usize with try_into().
On 32-bit ARM, when this over-decrement would drive a count below zero,
the driver's existing refcount guard refuses it and fires:
rust_binder: Failure: refcount underflow!
References
Configurations
Configuration 1 (hide)
|
History
12 Nov 2026, 18:01
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-191 | |
| First Time |
Linux linux Kernel
Linux |
|
| CPE | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.2:rc1:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.2:rc2:*:*:*:*:*:* |
|
| References | () https://git.kernel.org/stable/c/74920b1b4e474ba7a4de4323c0458deec49d210b - Patch | |
| References | () https://git.kernel.org/stable/c/803c8a9502e9b97cd6ae937618ef4a8fd6274343 - Patch | |
| References | () https://git.kernel.org/stable/c/89b8cc948dce661af87527623b3a41cdd115e2f9 - Patch |
Information
Published : 2026-07-25 10:17
Updated : 2026-11-12 18:01
NVD link : CVE-2026-64467
Mitre link : CVE-2026-64467
CVE.ORG link : CVE-2026-64467
JSON object : View
Products Affected
linux
- linux_kernel
CWE
CWE-191
Integer Underflow (Wrap or Wraparound)