Linux Kernel EUVD-2026-48811

The rust_binder module is the Rust-language reimplementation of Android's Binder IPC driver in the Linux kernel. When a binder Allocation is dropped, its cleanup routine walks an offsets array whose elements are binder_size_t (a u64 alias) pointing to embedded object positions within a transaction buffer. The bug is a type-width mismatch: the original code used Rust's usize (which is 32-bit wide on 32-bit architectures like ARM32) both as the iteration stride and the integer type used to read each 8-byte array entry. On 32-bit kernels this causes the iterator to step through the 8-byte entries in 4-byte increments (twice as many iterations), and each read returns only the low 32 bits of the u64 on the first pass and the high 32 bits (always zero) on the second pass, making every second read resolve to offset 0. The object at offset 0 is therefore decremented N extra times, corrupting the binder refcount state. CWE-N/A is listed, but the root cause is closest to CWE-681 (incorrect conversion between numeric types) combined with CWE-911 (improper update of reference count). Affected CPE: cpe:2.3:a:linux:linux.