CVE-2026-64466

A flaw was found in the Linux kernel's Rust Binder component. This vulnerability occurs when a freeze listener is not properly cleared upon node removal, leading to a reference count cycle. This can result in a memory leak, potentially impacting system stability and performance over time...

CVE-2026-64467

A flaw was found in the Linux kernel's rustbinder component. This vulnerability arises from an error in how memory offsets are handled during cleanup operations on 32-bit systems. An attacker could exploit this to corrupt the system's reference accounting, causing resources to be released...

SUSE CVE-2026-64467

In the Linux kernel, the following vulnerability has been resolved: rustbinder: use a u64 stride when cleaning up the offsets array Allocation's Drop walks the offsets array bindersizet = u64 entries, cleaning up the objects, but it used usize instead of u64 for both the stride and the per-entry...

CVE-2026-64467

In the Linux kernel, the following vulnerability has been resolved: rustbinder: use a u64 stride when cleaning up the offsets array Allocation's Drop walks the offsets array bindersizet = u64 entries, cleaning up the objects, but it used usize instead of u64 for both the stride and the per-entry...

UBUNTU-CVE-2026-64466

In the Linux kernel, the following vulnerability has been resolved: rustbinder: clear freeze listener on node removal Generally userspace is supposed to explicitly clear freeze listeners before they drop the refcount on the node ref to zero, but there's nothing forcing that. Currently, in this...

UBUNTU-CVE-2026-64467

In the Linux kernel, the following vulnerability has been resolved: rustbinder: use a u64 stride when cleaning up the offsets array Allocation's Drop walks the offsets array bindersizet = u64 entries, cleaning up the objects, but it used usize instead of u64 for both the stride and the per-entry...

CVE-2026-64467

The CVE-2026-64467 entry details a Linux kernel vulnerability in the rust_binder path. The issue occurs in Allocation’s Drop when walking the offsets array (binder_size_t = u64 entries): previously the stride and per-entry read used usize, causing 8-byte entries to be advanced in 4-byte steps on ...

CVE-2026-64467 rust_binder: use a u64 stride when cleaning up the offsets array

In the Linux kernel, the following vulnerability has been resolved: rustbinder: use a u64 stride when cleaning up the offsets array Allocation's Drop walks the offsets array bindersizet = u64 entries, cleaning up the objects, but it used usize instead of u64 for both the stride and the per-entry...

EUVD-2026-48811

In the Linux kernel, the following vulnerability has been resolved: rustbinder: use a u64 stride when cleaning up the offsets array Allocation's Drop walks the offsets array bindersizet = u64 entries, cleaning up the objects, but it used usize instead of u64 for both the stride and the per-entry...

CVE-2026-64467

In the Linux kernel, the following vulnerability has been resolved: rustbinder: use a u64 stride when cleaning up the offsets array Allocation's Drop walks the offsets array bindersizet = u64 entries, cleaning up the objects, but it used usize instead of u64 for both the stride and the per-entry...

CVE-2026-64467

In the Linux kernel, the following vulnerability has been resolved: rustbinder: use a u64 stride when cleaning up the offsets array Allocation's Drop walks the offsets array bindersizet = u64 entries, cleaning up the objects, but it used usize instead of u64 for both the stride and the per-entry...

CVE-2026-64467 rust_binder: use a u64 stride when cleaning up the offsets array

In the Linux kernel, the following vulnerability has been resolved: rustbinder: use a u64 stride when cleaning up the offsets array Allocation's Drop walks the offsets array bindersizet = u64 entries, cleaning up the objects, but it used usize instead of u64 for both the stride and the per-entry...

CVE-2026-64466

In the Linux kernel, the following vulnerability has been resolved: rustbinder: clear freeze listener on node removal Generally userspace is supposed to explicitly clear freeze listeners before they drop the refcount on the node ref to zero, but there's nothing forcing that. Currently, in this...

EUVD-2026-48810

In the Linux kernel, the following vulnerability has been resolved: rustbinder: clear freeze listener on node removal Generally userspace is supposed to explicitly clear freeze listeners before they drop the refcount on the node ref to zero, but there's nothing forcing that. Currently, in this...

CVE-2026-64466

CVE-2026-64466 affects the Linux kernel where, in the rust_binder component, a freeze listener may linger in the freeze_listeners red-black tree and the remote node’s listener list after the referenced object’s refcount reaches zero. This can create a refcount cycle and potentially a memory leak....

CVE-2026-64466 rust_binder: clear freeze listener on node removal

In the Linux kernel, the following vulnerability has been resolved: rustbinder: clear freeze listener on node removal Generally userspace is supposed to explicitly clear freeze listeners before they drop the refcount on the node ref to zero, but there's nothing forcing that. Currently, in this...

Linux Distros Unpatched Vulnerability : CVE-2026-64467

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - rustbinder: use a u64 stride when cleaning up the offsets array Allocation's Drop walks the offsets array bindersizet = u64 entries, cleaning up the objects, bu...

Linux Distros Unpatched Vulnerability : CVE-2026-64466

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - rustbinder: clear freeze listener on node removal Generally userspace is supposed to explicitly clear freeze listeners before they drop the refcount on the node...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: rustbinder: fixed oneway spam detection The spam detection logic in TreeRange was executed before the current request was inserted into the tree. As a result, the new request wasn’t taken into account in the spam calculation...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: rustbinder: The spinlock call in rustshrinkfreepage has been removed. When porting Rust Binder to version 6.18, I overlooked including the commit fb56fdf8b9a2 “mm/listlru: split the lock to per-cgroup scope” in the consideration...