{"affected":[{"conditional":false,"product":"linux_kernel","source":"NVD","vendor":"linux","versions":[{"greaterThanOrEqual":"6.18","lessThan":"6.18.39","status":"affected","version":"*","versionType":"custom"}]},{"conditional":false,"product":"linux_kernel","source":"NVD","vendor":"linux","versions":[{"greaterThanOrEqual":"6.19","lessThan":"7.1.4","status":"affected","version":"*","versionType":"custom"}]},{"conditional":false,"product":"linux_kernel","source":"NVD","vendor":"linux","versions":[{"status":"affected","version":"7.2","versionType":"custom"}]}],"cpeConfigurations":[{"negate":false,"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.18.39","versionStartIncluding":"6.18","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.1.4","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.2:rc1:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.2:rc2:*:*:*:*:*:*","vulnerable":true}],"negate":false,"operator":"OR"}],"operator":"OR"}],"cveId":"CVE-2026-64467","cwes":["CWE-191"],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nrust_binder: use a u64 stride when cleaning up the offsets array\n\nAllocation's Drop walks the offsets array (binder_size_t = u64 entries),\ncleaning up the objects, but it used usize instead of u64 for both the\nstride and the per-entry read.\n\nOn 64-bit kernels (usize == u64) this is harmless, but on 32-bit kernels\nit walks the 8-byte entries in 4-byte steps, iterating an N-entry array\n2N times, and reads the always-zero high word as offset 0, cleaning up\nthe object at offset 0 N extra times. As a result the referenced node or\nhandle ends up with a lower reference count than it actually has (a\nrefcount over-decrement), and binder's reference accounting is corrupted;\nfor example, the owner can be notified of a strong reference release\n(BR_RELEASE) even though references still remain.\n\nChange the stride to u64, and read each entry as a u64, narrowing it to\nusize with try_into().\n\nOn 32-bit ARM, when this over-decrement would drive a count below zero,\nthe driver's existing refcount guard refuses it and fires:\n\n  rust_binder: Failure: refcount underflow!","epss":{"date":"2026-11-10","percentile":0.0683,"score":0.00173},"exploits":[],"kev":null,"metrics":[{"score":8.8,"severity":"high","source":"NVD: 416baaa9-dc9f-4396-8d5f-8c081fb06d67","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","version":"3.1"}],"modifiedAt":1794506478470,"publishedAt":1784974652003,"references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/74920b1b4e474ba7a4de4323c0458deec49d210b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/803c8a9502e9b97cd6ae937618ef4a8fd6274343"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/89b8cc948dce661af87527623b3a41cdd115e2f9"}],"remediation":[{"kind":"fix","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://git.kernel.org/stable/c/74920b1b4e474ba7a4de4323c0458deec49d210b"},{"kind":"fix","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://git.kernel.org/stable/c/803c8a9502e9b97cd6ae937618ef4a8fd6274343"},{"kind":"fix","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://git.kernel.org/stable/c/89b8cc948dce661af87527623b3a41cdd115e2f9"}],"revision":"a31709030bc30497b4d3477ddde35280e4bf363137d6001c140bb464da264ab8","sources":[{"modifiedAt":1794506478470,"name":"NVD","retrievedAt":1794507348567,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64467"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1794462705707,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-64467"}],"ssvc":null,"status":"published","title":"CVE-2026-64467","updatedAt":1794507348567}