Executive brief
A vulnerability in the Linux kernel's Android Binder driver (specifically the Rust implementation) can lead to system instability on 32-bit systems. The Binder driver is a critical component used for communication between different processes on Android. An exploit could cause the system to incorrectly track memory references, potentially leading to premature resource release or system crashes.
Technical details
A vulnerability exists in the rust_binder driver within the Linux kernel due to an incorrect stride length used when iterating over the offsets array during the Drop implementation for Allocation. On 32-bit kernels, the code used 'usize' (4 bytes) instead of 'u64' (8 bytes) for the stride and per-entry read. This causes the iterator to walk 8-byte entries in 4-byte steps, leading to a refcount over-decrement and corruption of Binder's reference accounting. An attacker could potentially leverage this to trigger premature object release (e.g., BR_RELEASE) while references still exist. The issue is mitigated on 32-bit ARM by existing refcount guards that trigger a 'refcount underflow' failure. Patches have been released for various stable kernel branches.
Affected products
- Linux Linux Kernel 6.18, 7.1.4, 7.2-rc3
Timeline
- 2026-07-25: advisory: NVD publication date
- 2026-07-18: patched: Committed to stable kernel trees