A bug in the Linux kernel’s Binder module caused the Rust implementation to misinterpret an empty FDA (file descriptor array) object as a pointer fix‑up when the skip value was zero. The code then attempted to write eight bytes beyond the end of the buffer, triggering an out‑of‑bounds write. The kernel’s bounds check prevented a crash, resulting instead in an EINVAL error returned to userspace. The flaw does not provide a direct path to code execution but could allow an attacker to cause kernel memory corruption or a denial‑of‑service.

All Linux kernel 6.19 release candidates from rc1 through rc8, as listed by the supplied CPE entries. Any derivative of the kernel that incorporates the same binder source before the patch is also affected.

With a CVSS score of 7.8 the issue is high severity, but the EPSS score is below 1 % and the vulnerability is not in the CISA KEV catalog, indicating a low likelihood of exploitation in the wild. The most likely attack vector is local: an attacker who can invoke a Binder transaction that includes an empty FDA object, such as malicious applications on the same device, may trigger the out‑of‑bounds write. Because the kernel detects the overflow, only a denial‑of‑service or potential unstable state is expected, and no remote code execution is documented.