CVE-2026-64218 in Linux
Summary
by MITRE • 07/24/2026
In the Linux kernel, the following vulnerability has been resolved:
batman-adv: bla: fix report_work leak on backbone_gw purge
batadv_bla_purge_backbone_gw() removes stale backbone gateway entries, but fails to properly handle their associated report_work:
- If report_work is running, the purge must wait for it to finish before freeing the backbone_gw, otherwise the worker may access freed memory (e.g. bat_priv). - If report_work is pending, the purge must cancel it and release the reference held for that pending work item.
The previous implementation called hlist_for_each_entry_safe() inside a spin_lock_bh() section, but cancel_work_sync() may sleep and therefore cannot be called from within a spinlock-protected region.
Restructure the loop to handle one entry per spinlock critical section: acquire the lock, find the next entry to purge, remove it from the hash list, then release the lock before calling cancel_work_sync() and dropping the hash_entry reference. Repeat until no more entries require purging.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/24/2026
The vulnerability identified in the linux kernel's batman-adv module represents a critical memory management flaw within the bridge loop avoidance protocol implementation. This issue specifically affects the bla subsystem responsible for maintaining backbone gateway information in wireless mesh networks. The problem manifests when batadv_bla_purge_backbone_gw() function attempts to clean up stale backbone gateway entries while failing to properly synchronize with associated work items that may be executing or pending execution.
The technical root cause stems from improper handling of work queue synchronization within a spinlock-protected critical section. When the purge function processes backbone gateway entries using hlist_for_each_entry_safe() inside a spin_lock_bh() context, it encounters a fundamental conflict with the cancel_work_sync() function which is designed to sleep during its operation. This sleeping behavior directly violates the atomic nature required by spinlock protection mechanisms and creates potential for use-after-free conditions where worker threads might access memory that has already been deallocated.
The operational impact of this vulnerability extends beyond simple memory corruption to potentially compromise the stability and security of wireless mesh network operations. When backbone gateway entries are prematurely freed while active work items reference them, the system may experience kernel panics, data corruption, or undefined behavior that could be exploited by malicious actors to disrupt network services or escalate privileges within the mesh network infrastructure.
This vulnerability aligns with CWE-415: Double Free and CWE-416: Use After Free categories from the Common Weakness Enumeration framework, specifically demonstrating improper resource management where memory allocation and deallocation sequences are not properly synchronized. The issue also relates to ATT&CK technique T1059.001: Command and Scripting Interpreter for potential exploitation through system instability, though this particular vulnerability is more focused on kernel-level memory corruption than user-space command execution.
The recommended mitigation strategy involves restructuring the purge function to separate lock acquisition from work item cancellation operations. The solution requires implementing a loop that acquires spinlock protection, identifies and removes entries from hash lists within the critical section, then releases the lock before performing potentially blocking operations like cancel_work_sync(). This approach ensures proper synchronization while maintaining the atomicity required for concurrent data structure modifications in kernel space.
The fix pattern demonstrates proper kernel programming practices by avoiding nested locking scenarios and ensuring that sleeping operations occur outside of spinlock-protected regions. This methodology prevents the kernel from deadlocking or entering undefined states during cleanup operations, particularly important in real-time network environments where consistent performance and reliability are paramount for maintaining mesh connectivity and data transmission integrity. The implementation also follows best practices for reference counting and work queue management within kernel subsystems, ensuring that all resource dependencies are properly handled before memory deallocation occurs.