The vulnerability occurs in the rust_binder driver of the Linux kernel. The driver stores offsets as 64‑bit entries but uses a 32‑bit stride and per‑entry read when the drop logic walks the array. On 32‑bit kernels this causes the array to be traversed twice, leading to the reference count of some objects being decremented beyond its intended value. The result is reference count under‑decrement, which corrupts binder's reference accounting. This error is a resource‑management flaw classified as CWE‑399.

The flaw applies to 32‑bit Linux kernel builds that include the original rust_binder implementation (e.g., ARM32 and other 32‑bit architectures where usize is 32 bits). It is not present on 64‑bit kernels because usize equals 64 bits. No specific kernel version range is listed, so any kernel prior to the patch that contains the stride bug is potentially vulnerable.

The CVSS score of 8.8 indicates high severity. The EPSS score of less than 1% shows a very low current exploitation probability, and the vulnerability is not listed in CISA's KEV catalog, indicating no known public exploitation. Based on the description, it is inferred that an attacker would need privileged or kernel‑level access to trigger the faulty cleanup, such as loading a malicious module or performing a local privilege‑escalation attack. The guard may indicate a panic condition, but that is inferred from the message. The impact could lead to incorrect reference accounting or a kernel panic, potentially causing a denial of service.