CVE-2026-64092 batman-adv: tp_meter: fix tp_vars reference leak in receiver shutdown
A race condition in the batman-adv module's receiver shutdown logic causes a reference leak, potentially leading to resource exhaustion and denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-64092?
CVE-2026-64092 is a medium-severity vulnerability in Linux kernel, published on 19 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
batman-adv: tp_meter: fix tp_vars reference leak in receiver shutdown
The receiver shutdown timer handler, batadv_tp_receiver_shutdown(), is responsible for releasing the tp_vars reference it holds. However, the existing logic for coordinating this release with batadv_tp_stop_all() was flawed.
timer_shutdown_sync() guarantees the timer will not fire again after it returns, but it returns non-zero only when the timer was pending at the time of the call. If the timer had already expired (and batadv_tp_stop_all() would unsucessfully try to rearm itself), batadv_tp_stop_all() skips its batadv_tp_vars_put(), and batadv_tp_receiver_shutdown() fails to put its own reference as well.
Fix this by introducing a new atomic variable receiving that is set to 1 when the receiver is initialized and cleared atomically with atomic_xchg() by whichever side claims it first. Only the side that observes the transition from 1 to 0 is responsible for releasing the tp_vars timer reference, eliminating the uncertainty.
Which versions are affected by CVE-2026-64092?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-64092?
Apply the vendor's patch.
Is CVE-2026-64092 being exploited?
There is no known exploitation of CVE-2026-64092 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2026-64092, DEBIAN-CVE-2026-64092, GHSA-hc2g-7m28-vw77, ROOT-OS-DEBIAN-11-CVE-2026-64092, UBUNTU-CVE-2026-64092.