CVE-2026-64094
Received Received - Intake

batman-adv: NULL Pointer Dereference in BLA Claim Handling

Publication date: 2026-07-19

Last updated on: 2026-07-19

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: batman-adv: bla: avoid NULL-ptr deref for claim via dropped interface Without rtnl_lock held, a hardif might be retrieved as primary interface of a meshif, but then (while operating on this interface) getting decoupled from the mesh interface. In this case, the meshif still exists but the pointer from the primary hardif to the meshif is set to NULL. The mesh_iface must be checked first to be non-NULL before continuing to send an ARP request using meshif.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-19
Last Modified
2026-07-19
Generated
2026-07-20
AI Q&A
2026-07-19
EPSS Evaluated
N/A
NVD
CVE-2026-64094
EUVD
EUVD-2026-45779

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a NULL-pointer dereference in the batman-adv module related to BLA (Bridge Loop Avoidance). When an interface is dropped while operating on it, the mesh interface pointer may become NULL. The code fails to check this pointer before using it to send an ARP request, potentially causing a crash.

Detection Guidance

This vulnerability is specific to the Linux kernel's batman-adv module and involves a NULL-pointer dereference in BLA (Bridge Loop Avoidance) handling. Detection requires checking kernel logs for crashes or errors related to batman-adv, such as NULL pointer dereferences in mesh interface operations.

Impact Analysis

This vulnerability could lead to system crashes or instability in systems running the affected Linux kernel version with batman-adv enabled. It may cause denial-of-service conditions if exploited maliciously or through misconfiguration.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a Linux kernel issue related to network interface handling that could lead to system instability or crashes but does not involve data breaches or unauthorized access.

Mitigation Strategies

Update the Linux kernel to a patched version that resolves this issue. Monitor kernel logs for batman-adv related errors. If using batman-adv, ensure interfaces are properly managed to avoid NULL pointer dereferences during operations.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64094. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart