SB2026072785 - Incorrect calculation in Linux kernel android binder driver

Description

This security bulletin contains information about 1 vulnerability.

1) Incorrect calculation (CVE-ID: CVE-2026-64467)

CWE-ID: CWE-682 - Incorrect Calculation

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to corrupt binder reference accounting.

The vulnerability exists due to an incorrect integer type usage in the rust_binder allocation cleanup logic in drivers/android/binder/allocation.rs when cleaning up the offsets array on 32-bit kernels. A local user can trigger cleanup of crafted binder objects to corrupt binder reference accounting.

On affected 32-bit kernels, 8-byte offsets entries are processed in 4-byte steps, causing extra cleanup of the object at offset 0 and potentially triggering refcount underflow protection.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/74920b1b4e474ba7a4de4323c0458deec49d210b
• https://git.kernel.org/stable/c/803c8a9502e9b97cd6ae937618ef4a8fd6274343
• https://git.kernel.org/stable/c/89b8cc948dce661af87527623b3a41cdd115e2f9