CVE-2026-64092

Analyzed Analyzed - Analysis Complete

Memory Leak in batman-adv tp_meter

Publication date: 2026-07-19

Last updated on: 2026-08-11

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: batman-adv: tp_meter: fix tp_vars reference leak in receiver shutdown The receiver shutdown timer handler, batadv_tp_receiver_shutdown(), is responsible for releasing the tp_vars reference it holds. However, the existing logic for coordinating this release with batadv_tp_stop_all() was flawed. timer_shutdown_sync() guarantees the timer will not fire again after it returns, but it returns non-zero only when the timer was pending at the time of the call. If the timer had already expired (and batadv_tp_stop_all() would unsucessfully try to rearm itself), batadv_tp_stop_all() skips its batadv_tp_vars_put(), and batadv_tp_receiver_shutdown() fails to put its own reference as well. Fix this by introducing a new atomic variable receiving that is set to 1 when the receiver is initialized and cleared atomically with atomic_xchg() by whichever side claims it first. Only the side that observes the transition from 1 to 0 is responsible for releasing the tp_vars timer reference, eliminating the uncertainty.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-19

Last Modified

2026-08-11

Generated

2026-08-29

AI Q&A

2026-07-19

EPSS Evaluated

2026-08-28

NVD

CVE-2026-64092

EUVD

EUVD-2026-45777

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	7.1
linux	linux_kernel	From 5.10.259 (inc) to 5.11 (exc)
linux	linux_kernel	From 6.12.90 (inc) to 6.12.92 (exc)
linux	linux_kernel	From 6.18.32 (inc) to 6.18.34 (exc)
linux	linux_kernel	From 6.6.140 (inc) to 6.6.142 (exc)
linux	linux_kernel	From 7.0.9 (inc) to 7.0.11 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a reference leak vulnerability in the Linux kernel's batman-adv module. The issue occurs in the tp_meter component during receiver shutdown. The timer handler responsible for releasing a reference to tp_vars does not properly coordinate with another function (batadv_tp_stop_all). If the timer expires before shutdown, the cleanup process fails to release the reference, causing a memory leak.

Detection Guidance

This vulnerability is specific to the Linux kernel's batman-adv module and involves a reference leak in the tp_meter receiver shutdown process. Detection requires checking for kernel logs or system behavior related to batman-adv module operations. No direct commands are provided in the context to detect this issue.

Impact Analysis

This vulnerability could lead to memory exhaustion over time as leaked references accumulate. Systems running affected versions of the Linux kernel with batman-adv enabled may experience performance degradation or crashes due to increased memory usage. It primarily affects routers or systems using batman-adv for mesh networking.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA as it is a low-level kernel memory reference leak issue in the batman-adv protocol implementation. Compliance impacts would only occur if this vulnerability led to system instability or data corruption, which is not indicated in the provided context.

Mitigation Strategies

Update the Linux kernel to the latest patched version to resolve the batman-adv tp_meter tp_vars reference leak issue.

Hi! I’m here to help you understand CVE-2026-64092. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70