CVE-2026-64093

Analyzed Analyzed - Analysis Complete

Timer Shutdown Race Condition in batman-adv tp_meter

Publication date: 2026-07-19

Last updated on: 2026-08-11

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: batman-adv: tp_meter: directly shut down timer on cleanup batadv_tp_sender_cleanup() was calling timer_delete_sync() followed by timer_delete() to guard against the timer handler re-arming itself between the two calls. This double-deletion hack relied on the sending status being set to 0 to suppress re-arming. Replace both calls with a single timer_shutdown_sync(). This function both waits for any running timer callback to complete (like timer_delete_sync()) and permanently disarms the timer so it cannot be re-armed afterwards, making re-arming prevention unconditional and self-documenting. The re-arming property is also required because otherwise: 1. context 0 (batadv_tp_recv_ack()) checks in batadv_tp_reset_sender_timer() if sending is still 1 -> it is 2. context 1 changes in batadv_tp_sender_shutdown() sending to 0 and in this process forces the kthread to stop timer in batadv_tp_sender_cleanup() 3. context 0 continues in batadv_tp_reset_sender_timer() and rearms the timer -> but the reference for it is already gone

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-19

Last Modified

2026-08-11

Generated

2026-08-29

AI Q&A

2026-07-19

EPSS Evaluated

2026-08-28

NVD

CVE-2026-64093

EUVD

EUVD-2026-45778

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	From 6.13 (inc) to 6.18.34 (exc)
linux	linux_kernel	From 6.19 (inc) to 7.0.11 (exc)
linux	linux_kernel	From 5.16 (inc) to 6.1.176 (exc)
linux	linux_kernel	From 6.2 (inc) to 6.6.143 (exc)
linux	linux_kernel	From 6.7 (inc) to 6.12.93 (exc)
linux	linux_kernel	From 4.8 (inc) to 5.15.210 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a Linux kernel vulnerability in the batman-adv module's tp_meter component. It involves a timer management issue where batadv_tp_sender_cleanup() improperly handled timer deletion, risking a race condition that could lead to timer re-arming after cleanup. The fix replaces double timer deletion with a single timer_shutdown_sync() call to prevent re-arming.

Detection Guidance

This vulnerability is specific to the Linux kernel's batman-adv module and does not have a direct detection method via network commands. It requires checking the kernel version and batman-adv module for the affected code paths. Inspect the kernel logs for timer-related errors in batman-adv or use kernel debugging tools to verify timer shutdown behavior.

Impact Analysis

If exploited, this could cause system instability or crashes in systems using batman-adv's tp_meter feature. It may lead to unexpected behavior in network performance monitoring or routing protocols relying on this component.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a Linux kernel issue in the batman-adv module related to timer management in the tp_meter component, which could lead to system instability or crashes but does not involve data handling or privacy violations.

Mitigation Strategies

Update the Linux kernel to a patched version that includes the fix for CVE-2026-64093. If using batman-adv, ensure you are running a version with the timer_shutdown_sync() implementation. Reboot the system after applying the kernel update to activate the changes.

Hi! I’m here to help you understand CVE-2026-64093. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70