CVE-2026-64466
Received Received - Intake

Memory Leak in Linux Kernel Rust Binder

Publication date: 2026-07-25

Last updated on: 2026-07-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: rust_binder: clear freeze listener on node removal Generally userspace is supposed to explicitly clear freeze listeners before they drop the refcount on the node ref to zero, but there's nothing forcing that. Currently, in this scenario the freeze listener remains in the freeze_listeners rbtree and in the remote node's freeze listener list, even though the ref for which the listener is registered is gone. This could potentially lead to a memory leak due to a refcount cycle. Thus, remove the freeze listener in this scenario.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-25
Last Modified
2026-07-25
Generated
2026-08-14
AI Q&A
2026-07-25
EPSS Evaluated
2026-08-13
NVD
CVE-2026-64466
EUVD
EUVD-2026-48810

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a memory leak caused by improper handling of freeze listeners in the rust_binder component. When userspace fails to clear freeze listeners before dropping the reference count on a node, the listener remains in data structures even after the associated reference is gone. This creates a reference count cycle that can lead to memory leaks.

Detection Guidance

This vulnerability is specific to the Linux kernel's rust_binder implementation and does not have a direct network detection method. It requires kernel-level inspection. Check for kernel logs or dmesg output for binder-related errors or memory leaks. Use commands like 'dmesg | grep binder' or 'journalctl -k | grep binder' to monitor for issues.

Impact Analysis

The impact is primarily on system stability and resource usage. A memory leak could cause the system to gradually consume more memory over time, potentially leading to performance degradation or crashes if the leaked memory accumulates significantly.

Compliance Impact

This vulnerability does not directly impact compliance with GDPR, HIPAA, or similar standards. It involves a memory leak in the Linux kernel's binder driver due to a refcount cycle, which is a technical issue rather than a data protection or privacy concern.

Mitigation Strategies

Update your Linux kernel to the latest stable version that includes the fix for this vulnerability. Monitor kernel updates from your distribution vendor and apply patches promptly. No additional configuration changes are required beyond the kernel update.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64466. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart