CVE-2026-64467: Linux Kernel Privilege Escalation Flaw

CVE-2026-64467 Overview

CVE-2026-64467 is a Linux kernel vulnerability in the rust_binder driver that causes reference count corruption during allocation cleanup. The Allocation's Drop implementation walks the offsets array using usize for both the stride and per-entry read, instead of the correct u64 type (binder_size_t). On 32-bit kernels this causes the driver to iterate 8-byte entries in 4-byte steps, processing an N-entry array 2N times and repeatedly cleaning up the object at offset 0. The result is a refcount over-decrement that corrupts binder's reference accounting.

Critical Impact
Local users on 32-bit Linux kernels running rust_binder can trigger reference count underflows, leading to premature release notifications (BR_RELEASE) and potential use-after-free conditions in IPC objects.

Affected Products

Linux kernel builds that include the rust_binder driver
32-bit kernel configurations where usize differs from u64 (for example, 32-bit ARM)
Android and embedded systems shipping rust_binder on 32-bit architectures

Discovery Timeline

2026-07-25 - CVE-2026-64467 published to NVD
2026-07-27 - Last updated in NVD database

Technical Details for CVE-2026-64467

Vulnerability Analysis

The rust_binder driver manages inter-process communication (IPC) objects using an offsets array where each entry is a binder_size_t (equivalent to u64). When an Allocation is dropped, the driver walks this array to release references on each embedded object. The cleanup routine incorrectly used usize as both the iteration stride and the read size for each entry.

On 64-bit kernels, usize equals u64, so the behavior is correct. On 32-bit kernels, usize is 4 bytes while each entry is 8 bytes. The loop advances by 4 bytes per iteration, visiting each entry twice and misinterpreting the always-zero high word of every entry as offset 0. The driver then invokes cleanup on the object at offset 0 an extra N times per array.

This over-decrement corrupts the reference accounting of the underlying node or handle. The owner can receive a strong reference release notification (BR_RELEASE) while valid references still exist. On 32-bit ARM, the driver's existing refcount guard detects when a count would go below zero and logs rust_binder: Failure: refcount underflow!.

Root Cause

The root cause is a type-size mismatch [CWE-681-adjacent] between the on-disk entry width (u64) and the Rust type used for stride and read operations (usize). The fix changes the stride to u64 and reads each entry as a u64, narrowing to usize via try_into().

Attack Vector

Exploitation requires local access and the ability to invoke binder IPC operations from userspace. An attacker crafts binder transactions containing offsets arrays that reference objects whose reference counts can be manipulated through repeated cleanup passes. Because binder is exposed to unprivileged applications on Android, any local process with binder access can trigger the flawed cleanup path.

The over-decrement can be used to prematurely destroy binder nodes or handles that other processes still rely on, enabling use-after-free conditions and potential privilege escalation. Refer to the upstream kernel commit for the exact code change.

Detection Methods for CVE-2026-64467

Indicators of Compromise

Kernel log entries containing rust_binder: Failure: refcount underflow! on 32-bit systems
Unexpected BR_RELEASE notifications received by binder clients while references are still held
Application crashes or IPC failures correlated with binder transactions on 32-bit ARM devices

Detection Strategies

Monitor dmesg and /var/log/kern.log for rust_binder refcount underflow messages
Audit running kernel versions against the fixed commits 74920b1b4e47, 803c8a9502e9, and 89b8cc948dce
Track binder-related kernel oops or panic events on 32-bit deployments and correlate with process activity

Monitoring Recommendations

Enable kernel audit logging on Android and embedded Linux fleets running 32-bit builds with rust_binder enabled
Ingest kernel logs into a centralized SIEM to alert on refcount underflow strings and binder anomalies
Baseline expected binder transaction patterns per application to surface abusive or repeated cleanup triggers

How to Mitigate CVE-2026-64467

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the CVE and rebuild affected 32-bit kernels
Prioritize patching on 32-bit ARM systems where the underflow guard actively fires
Restrict untrusted local application execution on affected devices until patches are deployed

Patch Information

The fix changes the offsets array stride to u64 and reads each entry as a u64 before narrowing it to usize with try_into(). Patched commits are available in the stable kernel tree: commit 74920b1b4e47, commit 803c8a9502e9, and commit 89b8cc948dce. Distribution vendors should backport these commits to any 32-bit kernel shipping rust_binder.

Workarounds

Disable the rust_binder driver on affected 32-bit builds and revert to the C binder implementation where feasible
Limit binder access using SELinux or AppArmor policies to trusted applications only
Deploy 64-bit kernels where hardware supports them, since the bug is harmless when usize == u64

bash

# Verify running kernel and check for the fix
uname -a
zcat /proc/config.gz | grep -i CONFIG_RUST_BINDER
dmesg | grep -i "rust_binder"