Executive brief
A vulnerability was identified in the Linux kernel's batman-adv mesh networking module. This flaw could allow a local attacker to cause a system crash or potentially execute unauthorized actions due to improper memory management during network node cleanup. The issue specifically affects systems using the B.A.T.M.A.N. Advanced protocol for wireless mesh networking.
Technical details
A use-after-free vulnerability exists in net/batman-adv/originator.c within the Linux kernel. The function batadv_mcast_purge_orig() removes entries from RCU-protected hlists without waiting for an RCU grace period. Consequently, concurrent RCU readers may attempt to access references to these entries, such as mcast_want_all_ipv6_node, after the memory has been reclaimed. The fix involves moving the purge call to batadv_orig_node_release() before the call_rcu() invocation to ensure all readers have drained. Patches have been released across multiple stable kernel branches.
Affected products
- Linux Linux kernel 3.15 to 5.10.258
Timeline
- 2026-07-19: advisory: CVE-2026-64096 published by NVD
- 2026-05-14: patched: Initial fix authored by Sven Eckelmann
References
- https://git.kernel.org/stable/c/20c2d6a20ca936f5aaa6dd40f73f262ac45c87cc
- https://git.kernel.org/stable/c/70bcb678561f0fb58f33270fc73f12f3be72b878
- https://git.kernel.org/stable/c/78a63fb2f7d5630d1c1f2859a20d4e4226863b41
- https://git.kernel.org/stable/c/8a3707653ab658e082ccd992e92594e01b09a3fc
- https://git.kernel.org/stable/c/aef897c9d2dd0d9339167fb82b62beff68d076cb
- https://git.kernel.org/stable/c/ced48f55bac73f0822eae90509e51b42b4f646c8
- https://git.kernel.org/stable/c/edfb1e094104a50f931553dc82ac59246569fd32