CVE-2026-64095
Received Received - Intake

Race Condition in batman-adv BLA Mechanism Leads to num_requests Mismanagement

Publication date: 2026-07-19

Last updated on: 2026-07-19

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: batman-adv: bla: avoid double decrement of bla.num_requests The bla.num_requests is increased when no request_sent was in progress. And it is decremented in various places (announcement was received, backbone is purged, periodic work). But the check if the request_sent is actually set to a specific state and the atomic_dec/_inc are not safe because they are not atomic (TOCTOU) and multiple such code portions can run concurrently. At the same time, it is necessary to modify request_sent (state) and bla.num_requests atomically. Otherwise batadv_bla_send_request() might set request_sent to 1 and is interrupted. batadv_handle_announce() can then set request_sent back to 0 and decrement num_requests before batadv_bla_send_request() incremented it. The two operations must therefore be locked. And since state (request_sent) and wait_periods are only accessed inside this lock, they can be converted to simpler datatypes. And to avoid that the bla.num_requests is touched by a parallel running context with a valid backbone_gw reference after batadv_bla_purge_backbone_gw() ran, a third state "stopped" is required to correctly signal that a backbone_gw is in the state of being cleaned up.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-19
Last Modified
2026-07-19
Generated
2026-07-20
AI Q&A
2026-07-19
EPSS Evaluated
N/A
NVD
CVE-2026-64095
EUVD
EUVD-2026-45780

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a race condition in the batman-adv module's BLA (Bridge Loop Avoidance) implementation. The issue occurs when bla.num_requests is incorrectly decremented due to non-atomic operations, allowing concurrent code paths to interfere with each other. This leads to potential double decrements or incorrect state management in request_sent and bla.num_requests.

Detection Guidance

This vulnerability is specific to the Linux kernel's batman-adv module and involves a race condition in the BLA (Bridge Loop Avoidance) mechanism. Detection requires checking kernel logs for related errors or monitoring batman-adv module behavior. Commands like 'dmesg | grep batman' or 'journalctl -k | grep batman' may help identify issues.

Impact Analysis

This vulnerability could cause incorrect BLA state tracking, leading to network loops or packet forwarding issues in systems using batman-adv. It may disrupt network stability and cause performance degradation or connectivity problems in mesh networks relying on this protocol.

Compliance Impact

This vulnerability affects compliance with standards and regulations like GDPR and HIPAA by potentially enabling unauthorized data access or manipulation due to improper synchronization in the Linux kernel's batman-adv module. The lack of atomic operations could lead to race conditions, compromising data integrity and confidentiality.

Mitigation Strategies

Update the Linux kernel to a patched version where this issue is resolved. If immediate patching is not possible, disable the batman-adv module if BLA functionality is not critical to your network operations.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64095. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart