CVE-2026-64467

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-64467", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-07-19T15:36:31.790Z", "datePublished": "2026-07-25T08:51:32.626Z", "dateUpdated": "2026-08-17T04:56:12.747Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-17T04:56:12.747Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nrust_binder: use a u64 stride when cleaning up the offsets array\n\nAllocation's Drop walks the offsets array (binder_size_t = u64 entries),\ncleaning up the objects, but it used usize instead of u64 for both the\nstride and the per-entry read.\n\nOn 64-bit kernels (usize == u64) this is harmless, but on 32-bit kernels\nit walks the 8-byte entries in 4-byte steps, iterating an N-entry array\n2N times, and reads the always-zero high word as offset 0, cleaning up\nthe object at offset 0 N extra times. As a result the referenced node or\nhandle ends up with a lower reference count than it actually has (a\nrefcount over-decrement), and binder's reference accounting is corrupted;\nfor example, the owner can be notified of a strong reference release\n(BR_RELEASE) even though references still remain.\n\nChange the stride to u64, and read each entry as a u64, narrowing it to\nusize with try_into().\n\nOn 32-bit ARM, when this over-decrement would drive a count below zero,\nthe driver's existing refcount guard refuses it and fires:\n\n rust_binder: Failure: refcount underflow!"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable path is reached through a local BINDER_WRITE_READ ioctl carrying a crafted Binder transaction.\nAC:L - The attacker controls object zero and the offsets count and can force synchronous cleanup with a later invalid object; no race or uncontrollable condition is required.\nPR:L - An ordinary process permitted to access the Binder device and invoke and transfer objects to the target can trigger the bug; no capability or administrative privilege is required.\nUI:N - A malformed later object makes transaction construction fail and invokes cleanup during the attacker's ioctl, without recipient or human action.\nS:C - Prematurely releasing an object owned by a more privileged Binder service can create a user-space use-after-free across the Android application sandbox boundary.\nC:H - The attacker can retain a handle after BR_RELEASE frees the owning service's object, then target the stale pointer and potentially obtain code execution and arbitrary access to privileged-process memory.\nI:H - Exploitation of the resulting stale Binder object can provide attacker-controlled code execution and arbitrary modification within the privileged owning service.\nA:H - Stale-object dispatch can crash a critical Binder service, and the trigger can be repeated to cause persistent service or system disruption."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/android/binder/allocation.rs"], "versions": [{"version": "eafedbc7c050c44744fbdf80bdf3315e860b7513", "lessThan": "89b8cc948dce661af87527623b3a41cdd115e2f9", "status": "affected", "versionType": "git"}, {"version": "eafedbc7c050c44744fbdf80bdf3315e860b7513", "lessThan": "74920b1b4e474ba7a4de4323c0458deec49d210b", "status": "affected", "versionType": "git"}, {"version": "eafedbc7c050c44744fbdf80bdf3315e860b7513", "lessThan": "803c8a9502e9b97cd6ae937618ef4a8fd6274343", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/android/binder/allocation.rs"], "versions": [{"version": "6.18", "status": "affected"}, {"version": "0", "lessThan": "6.18", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.39", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.4", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.18", "versionEndExcluding": "6.18.39"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.18", "versionEndExcluding": "7.1.4"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.18", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/89b8cc948dce661af87527623b3a41cdd115e2f9"}, {"url": "https://git.kernel.org/stable/c/74920b1b4e474ba7a4de4323c0458deec49d210b"}, {"url": "https://git.kernel.org/stable/c/803c8a9502e9b97cd6ae937618ef4a8fd6274343"}], "title": "rust_binder: use a u64 stride when cleaning up the offsets array", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/android/binder/allocation.rs"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "89b8cc948dce661af87527623b3a41cdd115e2f9", "status": "affected", "version": "eafedbc7c050c44744fbdf80bdf3315e860b7513", "versionType": "git"}, {"lessThan": "74920b1b4e474ba7a4de4323c0458deec49d210b", "status": "affected", "version": "eafedbc7c050c44744fbdf80bdf3315e860b7513", "versionType": "git"}, {"lessThan": "803c8a9502e9b97cd6ae937618ef4a8fd6274343", "status": "affected", "version": "eafedbc7c050c44744fbdf80bdf3315e860b7513", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/android/binder/allocation.rs"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.18"}, {"lessThan": "6.18", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.39", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.4", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "CA2CE3BD-0548-4984-8C39-F3D3DF4D64E1", "versionEndExcluding": "6.18.39", "versionStartIncluding": "6.18", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "6228DDD6-4557-4AA3-9F43-AB995D471E42", "versionEndExcluding": "7.1.4", "versionStartIncluding": "6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.2:rc1:*:*:*:*:*:*", "matchCriteriaId": "5E8B9085-7ADB-4A05-89EF-12949B6A0509", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.2:rc2:*:*:*:*:*:*", "matchCriteriaId": "1FC0D50D-9D58-4947-A197-A5A3FF07E7E3", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nrust_binder: use a u64 stride when cleaning up the offsets array\n\nAllocation's Drop walks the offsets array (binder_size_t = u64 entries),\ncleaning up the objects, but it used usize instead of u64 for both the\nstride and the per-entry read.\n\nOn 64-bit kernels (usize == u64) this is harmless, but on 32-bit kernels\nit walks the 8-byte entries in 4-byte steps, iterating an N-entry array\n2N times, and reads the always-zero high word as offset 0, cleaning up\nthe object at offset 0 N extra times. As a result the referenced node or\nhandle ends up with a lower reference count than it actually has (a\nrefcount over-decrement), and binder's reference accounting is corrupted;\nfor example, the owner can be notified of a strong reference release\n(BR_RELEASE) even though references still remain.\n\nChange the stride to u64, and read each entry as a u64, narrowing it to\nusize with try_into().\n\nOn 32-bit ARM, when this over-decrement would drive a count below zero,\nthe driver's existing refcount guard refuses it and fires:\n\n rust_binder: Failure: refcount underflow!"}], "id": "CVE-2026-64467", "lastModified": "2026-11-12T18:01:18.470", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.0, "impactScore": 6.0, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-07-25T10:17:32.003", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/74920b1b4e474ba7a4de4323c0458deec49d210b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/803c8a9502e9b97cd6ae937618ef4a8fd6274343"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/89b8cc948dce661af87527623b3a41cdd115e2f9"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-191"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: rust_binder: use a u64 stride when cleaning up the offsets array", "id": "2507204", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2507204"}, "csaw": false, "cwe": "CWE-911", "details": ["A flaw was found in the Linux kernel's rust_binder component. This vulnerability arises from an error in how memory offsets are handled during cleanup operations on 32-bit systems. An attacker could exploit this to corrupt the system's reference accounting, causing resources to be released prematurely. This can lead to unexpected system behavior or instability, potentially resulting in a denial of service."], "name": "CVE-2026-64467", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-07-25T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-64467\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-64467\nhttps://lore.kernel.org/linux-cve-announce/2026072544-CVE-2026-64467-0754@gregkh/T"]}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[eafedbc7c050c44744fbdf80bdf3315e860b7513,89b8cc948dce661af87527623b3a41cdd115e2f9)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[eafedbc7c050c44744fbdf80bdf3315e860b7513,74920b1b4e474ba7a4de4323c0458deec49d210b)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[eafedbc7c050c44744fbdf80bdf3315e860b7513,803c8a9502e9b97cd6ae937618ef4a8fd6274343)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.18"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.18)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.39,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.4,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2-rc3,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-07-25T19:30:03.946933+00:00", "updated": "2026-08-02T12:45:06.518889+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-399", "CWE-911"]}