CVE-2026-64092 in Linux
Summary
by MITRE • 07/19/2026
In the Linux kernel, the following vulnerability has been resolved:
batman-adv: tp_meter: fix tp_vars reference leak in receiver shutdown
The receiver shutdown timer handler, batadv_tp_receiver_shutdown(), is responsible for releasing the tp_vars reference it holds. However, the existing logic for coordinating this release with batadv_tp_stop_all() was flawed.
timer_shutdown_sync() guarantees the timer will not fire again after it returns, but it returns non-zero only when the timer was pending at the time of the call. If the timer had already expired (and batadv_tp_stop_all() would unsucessfully try to rearm itself), batadv_tp_stop_all() skips its batadv_tp_vars_put(), and batadv_tp_receiver_shutdown() fails to put its own reference as well.
Fix this by introducing a new atomic variable receiving that is set to 1 when the receiver is initialized and cleared atomically with atomic_xchg() by whichever side claims it first. Only the side that observes the transition from 1 to 0 is responsible for releasing the tp_vars timer reference, eliminating the uncertainty.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/19/2026
The vulnerability resides in the batman-adv kernel module which implements the B.A.T.M.A.N. ad-hoc routing protocol for linux networks. This specific issue affects the tp_meter component responsible for traffic measurement and performance monitoring within the mesh network infrastructure. The flaw manifests as a reference leak in the tp_vars data structure that occurs during receiver shutdown operations, creating potential memory exhaustion conditions that could compromise system stability and availability.
The technical root cause stems from a race condition in the coordination between two critical functions: batadv_tp_receiver_shutdown() and batadv_tp_stop_all(). When the timer shutdown mechanism executes through timer_shutdown_sync(), it ensures no further timer invocations will occur but only returns a non-zero value when the timer was actively pending during the call. This creates a problematic scenario where if the timer had already expired before shutdown initiation, the batadv_tp_stop_all() function skips its reference release operation because it cannot successfully rearm itself. Consequently, the batadv_tp_receiver_shutdown() handler also fails to release its own tp_vars reference due to the ambiguous state coordination.
The vulnerability directly relates to CWE-412 and CWE-415 which address improper locking mechanisms and double-free conditions in kernel space operations. The flaw demonstrates characteristics consistent with improper reference counting practices that can lead to resource leaks and memory corruption. According to ATT&CK framework category T1068, this represents a privilege escalation vector through kernel memory manipulation, potentially allowing attackers to exhaust system resources or cause denial of service conditions.
The operational impact of this vulnerability extends beyond simple memory leaks to affect the overall reliability of mesh network operations within linux systems. When multiple concurrent shutdown sequences occur, particularly in high-traffic mesh environments, the reference leak accumulates over time until system memory becomes severely constrained. This degradation can manifest as system instability, application crashes, or complete system hang conditions that require manual intervention and reboot cycles.
The fix implements a robust atomic coordination mechanism using a new receiving variable with atomic_xchg() operations to establish clear ownership semantics between competing shutdown paths. This solution eliminates the race condition by ensuring only one execution path claims responsibility for tp_vars reference release, regardless of timer expiration states or concurrent access patterns. The implementation follows established kernel development practices for managing shared resources and prevents the accumulation of unreleased references that could eventually lead to system resource exhaustion and denial of service conditions.
The mitigation strategy requires updating affected linux kernel versions to include this specific fix within the batman-adv module, ensuring proper reference counting behavior during asynchronous shutdown operations. System administrators should prioritize applying kernel updates that contain this patch, particularly in production mesh network environments where reliability is critical. Regular monitoring of system memory usage and kernel logs should be implemented to detect potential recurrence of similar reference counting issues in other kernel subsystems that may exhibit analogous race condition vulnerabilities.