CVE-2026-64092
Received Received - Intake

Memory Leak in batman-adv tp_meter

Publication date: 2026-07-19

Last updated on: 2026-07-19

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: batman-adv: tp_meter: fix tp_vars reference leak in receiver shutdown The receiver shutdown timer handler, batadv_tp_receiver_shutdown(), is responsible for releasing the tp_vars reference it holds. However, the existing logic for coordinating this release with batadv_tp_stop_all() was flawed. timer_shutdown_sync() guarantees the timer will not fire again after it returns, but it returns non-zero only when the timer was pending at the time of the call. If the timer had already expired (and batadv_tp_stop_all() would unsucessfully try to rearm itself), batadv_tp_stop_all() skips its batadv_tp_vars_put(), and batadv_tp_receiver_shutdown() fails to put its own reference as well. Fix this by introducing a new atomic variable receiving that is set to 1 when the receiver is initialized and cleared atomically with atomic_xchg() by whichever side claims it first. Only the side that observes the transition from 1 to 0 is responsible for releasing the tp_vars timer reference, eliminating the uncertainty.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-19
Last Modified
2026-07-19
Generated
2026-07-20
AI Q&A
2026-07-19
EPSS Evaluated
N/A
NVD
CVE-2026-64092
EUVD
EUVD-2026-45777

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a reference leak vulnerability in the Linux kernel's batman-adv module. The issue occurs in the tp_meter component during receiver shutdown. The timer handler responsible for releasing a reference to tp_vars does not properly coordinate with another function (batadv_tp_stop_all). If the timer expires before shutdown, the cleanup process fails to release the reference, causing a memory leak.

Detection Guidance

This vulnerability is specific to the Linux kernel's batman-adv module and involves a reference leak in the tp_meter receiver shutdown process. Detection requires checking for kernel logs or system behavior related to batman-adv module operations. No direct commands are provided in the context to detect this issue.

Impact Analysis

This vulnerability could lead to memory exhaustion over time as leaked references accumulate. Systems running affected versions of the Linux kernel with batman-adv enabled may experience performance degradation or crashes due to increased memory usage. It primarily affects routers or systems using batman-adv for mesh networking.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA as it is a low-level kernel memory reference leak issue in the batman-adv protocol implementation. Compliance impacts would only occur if this vulnerability led to system instability or data corruption, which is not indicated in the provided context.

Mitigation Strategies

Update the Linux kernel to the latest patched version to resolve the batman-adv tp_meter tp_vars reference leak issue.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64092. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart