CVE-2026-64466: rust_binder: clear freeze listener on node removal
In the Linux kernel, the following vulnerability has been resolved:
rustbinder: clear freeze listener on node removal
Generally userspace is supposed to explicitly clear freeze listeners before they drop the refcount on the node ref to zero, but there's nothing forcing that. Currently, in this scenario the freeze listener remains in the freezelisteners rbtree and in the remote node's freeze listener list, even though the ref for which the listener is registered is gone. This could potentially lead to a memory leak due to a refcount cycle. Thus, remove the freeze listener in this scenario.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
rust_binder: clear freeze listener on node removalfrom your environment.Remove/clear the freeze listener in this scenario (so it is removed from the freeze_listeners rbtree on remote node removal before the node refcount is dropped to zero).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-64466?
CVE-2026-64466 has a risk severity score of 15.
How do I fix CVE-2026-64466?
To fix CVE-2026-64466, ensure that userspace explicitly clears freeze listeners before dropping the refcount on the node.
What systems are affected by CVE-2026-64466?
CVE-2026-64466 affects systems running the Linux kernel that utilize the rust_binder interface.
What type of vulnerability is CVE-2026-64466?
CVE-2026-64466 is a vulnerability related to improper management of freeze listeners in the Linux kernel.
When was CVE-2026-64466 published?
CVE-2026-64466 was published on July 25, 2026.