Incorrect calculation in Linux kernel - CVE-2026-64467

Vulnerability details

The vulnerability allows a local user to corrupt binder reference accounting.

The vulnerability exists due to an incorrect integer type usage in the rust_binder allocation cleanup logic in drivers/android/binder/allocation.rs when cleaning up the offsets array on 32-bit kernels. A local user can trigger cleanup of crafted binder objects to corrupt binder reference accounting.

On affected 32-bit kernels, 8-byte offsets entries are processed in 4-byte steps, causing extra cleanup of the object at offset 0 and potentially triggering refcount underflow protection.

Affected software

How to mitigate CVE-2026-64467

External References

• https://git.kernel.org/stable/c/74920b1b4e474ba7a4de4323c0458deec49d210b
• https://git.kernel.org/stable/c/803c8a9502e9b97cd6ae937618ef4a8fd6274343
• https://git.kernel.org/stable/c/89b8cc948dce661af87527623b3a41cdd115e2f9

Related Security Bulletins

• Incorrect calculation in Linux kernel android binder driver