CVE-2026-64096 batman-adv: mcast: fix use-after-free in orig_node RCU release
A use-after-free vulnerability in the Linux kernel's batman-adv module allows attackers to cause denial of service or execute arbitrary code.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-64096?
CVE-2026-64096 is a high-severity use after free vulnerability in Linux kernel, published on 19 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
batman-adv: mcast: fix use-after-free in orig_node RCU release
batadv_mcast_purge_orig() removes entries from RCU-protected hlists but does not wait for an RCU grace period before returning. Concurrent RCU readers may still accesses references to those entries at the point of removal. RCU-protected readers trying to operate on entries like orig->mcast_want_all_ipv6_node will then access already freed memory.
Fix this by moving batadv_mcast_purge_orig() to batadv_orig_node_release(), just before the call_rcu() invocation. This ensures RCU readers that were active at purge time have drained before the orig_node memory is reclaimed.
Weakness: CWE-416
Which versions are affected by CVE-2026-64096?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-64096?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-64096 being exploited?
There is no known exploitation of CVE-2026-64096 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2026-64096, DEBIAN-CVE-2026-64096, GHSA-jhvq-hvr2-2mgr, UBUNTU-CVE-2026-64096.