CVE-2026-64093 batman-adv: tp_meter: directly shut down timer on cleanup
A race condition in the batman-adv tp_meter cleanup allows a timer to be re-armed after its reference is freed, potentially causing a use-after-free and system crash.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-64093?
CVE-2026-64093 is a high-severity vulnerability in Linux kernel, published on 19 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
batman-adv: tp_meter: directly shut down timer on cleanup
batadv_tp_sender_cleanup() was calling timer_delete_sync() followed by timer_delete() to guard against the timer handler re-arming itself between the two calls. This double-deletion hack relied on the sending status being set to 0 to suppress re-arming.
Replace both calls with a single timer_shutdown_sync(). This function both waits for any running timer callback to complete (like timer_delete_sync()) and permanently disarms the timer so it cannot be re-armed afterwards, making re-arming prevention unconditional and self-documenting.
The re-arming property is also required because otherwise:
1. context 0 (batadv_tp_recv_ack()) checks in batadv_tp_reset_sender_timer() if sending is still 1 -> it is 2. context 1 changes in batadv_tp_sender_shutdown() sending to 0 and in this process forces the kthread to stop timer in batadv_tp_sender_cleanup() 3. context 0 continues in batadv_tp_reset_sender_timer() and rearms the timer -> but the reference for it is already gone
Which versions are affected by CVE-2026-64093?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-64093?
Apply the vendor's patch.
Is CVE-2026-64093 being exploited?
There is no known exploitation of CVE-2026-64093 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2026-64093, DEBIAN-CVE-2026-64093, GHSA-qf88-xw8w-824g, ROOT-OS-DEBIAN-11-CVE-2026-64093, ROOT-OS-UBUNTU-2204-CVE-2026-64093, UBUNTU-CVE-2026-64093.