CVE-2026-64090 in Linux
Summary
by MITRE • 07/19/2026
In the Linux kernel, the following vulnerability has been resolved:
batman-adv: tt: avoid empty VLAN responses
The commit 16116dac2339 ("batman-adv: prevent TT request storms by not sending inconsistent TT TLVLs") added checks to the local (direct) TT response code. But the response can also be done indirectly by another node using the global TT state. To avoid such inconsistency states reported in the original fix, also avoid sending empty VLANs for replies from the global TT state.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/19/2026
The vulnerability resides within the batman-adv kernel module which implements the Batman-Adv mesh routing protocol for linux systems. This specific issue affects how the Topology Table (TT) handles VLAN responses during network topology updates and routing decisions. The problem stems from an incomplete fix that addressed direct local TT response inconsistencies but failed to account for indirect responses originating from other nodes within the mesh network through the global TT state mechanism.
The technical flaw manifests when nodes in a Batman-Adv mesh network attempt to respond to TT requests with VLAN information that may be empty or inconsistent. While the initial commit 16116dac2339 successfully mitigated direct local TT response issues by preventing TT request storms, it did not consider the scenario where another node in the mesh network could indirectly generate responses through the global TT state. This oversight creates a potential inconsistency state where empty VLAN responses are sent during TT communication, which could lead to malformed routing information propagation throughout the mesh network.
The operational impact of this vulnerability includes potential disruption of mesh network routing functionality and increased risk of routing inconsistencies that may affect network performance and reliability. When empty VLAN responses are transmitted through the global TT state mechanism, they can cause downstream nodes to process invalid topology information, potentially leading to suboptimal routing decisions or complete routing failures within the mesh network. The vulnerability particularly affects networks that rely heavily on VLAN-based segmentation and dynamic topology updates.
This issue aligns with CWE-248, an unspecified weakness in which an exception is thrown but not caught, and relates to ATT&CK technique T1059.007 for command and scripting interpreter, though the actual exploitation would occur through routing protocol manipulation rather than direct command execution. The vulnerability also demonstrates characteristics similar to CWE-362, concurrent execution using shared resource with improper synchronization, as multiple nodes may concurrently process TT responses without proper consistency checks.
Mitigation strategies include applying the specific kernel patch that extends the original fix to cover global TT state responses, ensuring all VLAN responses are validated before transmission, and implementing monitoring for anomalous TT response patterns within the mesh network. Network administrators should also consider implementing additional quality of service controls and routing protocol validation mechanisms to detect and prevent propagation of inconsistent topology information. The fix ensures that nodes will not send empty VLAN responses even when processing indirect global TT state replies, thereby maintaining consistency in the mesh routing table updates.
The vulnerability highlights the complexity of distributed routing protocols where consistency must be maintained across multiple network nodes simultaneously. Proper synchronization between local and global state management is crucial for mesh networking protocols to maintain reliable operation. The solution demonstrates the importance of comprehensive testing for edge cases in distributed systems, particularly when dealing with indirect communication paths that may bypass direct validation mechanisms.