The Linux kernel's rust_binder component improperly used usize instead of u64 for the stride and per-entry read when cleaning up the offsets array. On 32-bit kernels, this caused the cleanup loop to iterate twice as many times as intended and read zeroed high words as offsets, leading to over-decrementing reference counts. This corrupted binder's reference accounting, potentially triggering strong reference release notifications prematurely. The fix involves using a u64 stride and reading each entry as u64, converting to usize safely. On 32-bit ARM, the driver's existing refcount guard detects and prevents underflow, firing an error.

On 32-bit Linux kernels, this vulnerability causes binder reference counts to be decremented more than they should be, corrupting reference accounting. This can lead to premature release notifications (BR_RELEASE) even when references remain, potentially causing use-after-free or other memory management issues. The impact includes confidentiality, integrity, and availability as indicated by the CVSS vector, but no known exploits are reported in the wild.

A fix has been implemented in the Linux kernel to correct the stride and entry read types to u64 with safe conversion. Users should apply the official kernel updates that include this fix. Since this is a kernel-level issue, upgrading to a patched kernel version is the recommended remediation. Patch status is not explicitly confirmed in the provided data; check the vendor or distribution advisories for the exact patched versions and update accordingly.