CVE-2026-64095 batman-adv: bla: avoid double decrement of bla.num_requests
A race condition in the batman-adv kernel module allows concurrent access to shared state, potentially causing a double decrement and leading to denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-64095?
CVE-2026-64095 is a high-severity vulnerability in Linux kernel, published on 19 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
batman-adv: bla: avoid double decrement of bla.num_requests
The bla.num_requests is increased when no request_sent was in progress. And it is decremented in various places (announcement was received, backbone is purged, periodic work). But the check if the request_sent is actually set to a specific state and the atomic_dec/_inc are not safe because they are not atomic (TOCTOU) and multiple such code portions can run concurrently.
At the same time, it is necessary to modify request_sent (state) and bla.num_requests atomically. Otherwise batadv_bla_send_request() might set request_sent to 1 and is interrupted. batadv_handle_announce() can then set request_sent back to 0 and decrement num_requests before batadv_bla_send_request() incremented it.
The two operations must therefore be locked. And since state (request_sent) and wait_periods are only accessed inside this lock, they can be converted to simpler datatypes. And to avoid that the bla.num_requests is touched by a parallel running context with a valid backbone_gw reference after batadv_bla_purge_backbone_gw() ran, a third state "stopped" is required to correctly signal that a backbone_gw is in the state of being cleaned up.
Which versions are affected by CVE-2026-64095?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-64095?
Apply the vendor's patch.
Is CVE-2026-64095 being exploited?
There is no known exploitation of CVE-2026-64095 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2026-64095, DEBIAN-CVE-2026-64095, GHSA-q65p-8m3g-4fpv, ROOT-OS-UBUNTU-2204-CVE-2026-64095, UBUNTU-CVE-2026-64095.