CVE-2026-64091

Analyzed Analyzed - Analysis Complete

Race Condition in Linux Kernel batman-adv TT Handling

Publication date: 2026-07-19

Last updated on: 2026-08-11

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: batman-adv: tt: fix TOCTOU race for reported vlans The local TT based TVLV is generated by first checking the number of VLANs which have at least one TT entry. A new buffer with the correct size for the VLANs is then allocated. Only then, the list of VLANs s used to fill the VLAN entries in the buffer. During this time, the meshif_vlan_list_lock is held. But the actual number of TT entries of each VLAN can still increase during this time - just not the number of VLANs in the list. But the prefilter used in the buffer size calculation might still cause an increase of the number of VLANs which need to be stored. Simply because a VLAN might now suddenly have at least one entry when it had none in the pre-alloc check - and then needs to occupy space which was not allocated. It is better to overestimate the buffer size at the beginning and then fill the buffer only with the VLANs which are not empty.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-19

Last Modified

2026-08-11

Generated

2026-08-29

AI Q&A

2026-07-19

EPSS Evaluated

2026-08-28

NVD

CVE-2026-64091

EUVD

EUVD-2026-45776

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	From 3.16.60 (inc) to 3.17 (exc)
linux	linux_kernel	4.17
linux	linux_kernel	4.17
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	From 6.13 (inc) to 6.18.34 (exc)
linux	linux_kernel	From 4.4.217 (inc) to 4.5 (exc)
linux	linux_kernel	From 6.19 (inc) to 7.0.11 (exc)
linux	linux_kernel	From 5.16 (inc) to 6.1.176 (exc)
linux	linux_kernel	From 6.2 (inc) to 6.6.143 (exc)
linux	linux_kernel	From 6.7 (inc) to 6.12.93 (exc)
linux	linux_kernel	From 5.11 (inc) to 5.15.210 (exc)
linux	linux_kernel	From 4.14.174 (inc) to 4.15 (exc)
linux	linux_kernel	From 4.17.1 (inc) to 5.10.259 (exc)
linux	linux_kernel	From 4.9.217 (inc) to 4.10 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-367	The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.

Attack-Flow Graph

Executive Summary

This is a TOCTOU (Time-of-Check to Time-of-Use) race condition in the Linux kernel's batman-adv module. It occurs when generating a local TT based TVLV buffer. The vulnerability arises because the number of VLANs with TT entries can increase between the initial size check and buffer allocation, leading to potential buffer overflow or incorrect data handling.

Detection Guidance

This vulnerability is specific to the Linux kernel's batman-adv module and involves a race condition in VLAN handling. Detection requires checking for the presence of the vulnerable code path in the kernel module. No direct commands are provided in the context to detect this issue. Review kernel logs for related errors or monitor batman-adv module behavior for inconsistencies.

Impact Analysis

This vulnerability could allow local attackers to cause a denial of service or potentially execute arbitrary code in the kernel. It may lead to system crashes, memory corruption, or privilege escalation if exploited.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it pertains to a race condition in the Linux kernel's batman-adv module related to VLAN handling. Compliance impacts would depend on system-specific configurations and usage rather than this vulnerability itself.

Mitigation Strategies

Update the Linux kernel to the latest patched version to resolve the batman-adv TT TOCTOU race condition in the TT based TVLV handling.

Hi! I’m here to help you understand CVE-2026-64091. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70