CVE-2026-64218

Analyzed Analyzed - Analysis Complete

Memory Leak in Linux Kernel batman-adv BLA Component

Publication date: 2026-07-24

Last updated on: 2026-08-11

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: batman-adv: bla: fix report_work leak on backbone_gw purge batadv_bla_purge_backbone_gw() removes stale backbone gateway entries, but fails to properly handle their associated report_work: - If report_work is running, the purge must wait for it to finish before freeing the backbone_gw, otherwise the worker may access freed memory (e.g. bat_priv). - If report_work is pending, the purge must cancel it and release the reference held for that pending work item. The previous implementation called hlist_for_each_entry_safe() inside a spin_lock_bh() section, but cancel_work_sync() may sleep and therefore cannot be called from within a spinlock-protected region. Restructure the loop to handle one entry per spinlock critical section: acquire the lock, find the next entry to purge, remove it from the hash list, then release the lock before calling cancel_work_sync() and dropping the hash_entry reference. Repeat until no more entries require purging.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-24

Last Modified

2026-08-11

Generated

2026-08-14

AI Q&A

2026-07-24

EPSS Evaluated

2026-08-12

NVD

CVE-2026-64218

EUVD

EUVD-2026-48626

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	From 5.16 (inc) to 6.1.175 (exc)
linux	linux_kernel	From 5.11 (inc) to 5.15.209 (exc)
linux	linux_kernel	From 6.7 (inc) to 6.12.92 (exc)
linux	linux_kernel	From 3.5 (inc) to 5.10.258 (exc)
linux	linux_kernel	From 6.13 (inc) to 6.18.34 (exc)
linux	linux_kernel	From 6.19 (inc) to 7.0.11 (exc)
linux	linux_kernel	From 6.2 (inc) to 6.6.142 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a Linux kernel vulnerability in the batman-adv module related to BLA (Bridge Loop Avoidance). It involves a memory leak and potential use-after-free issue when purging stale backbone gateway entries. The bug occurs because report_work tasks associated with these entries are not properly handled during cleanup, leading to possible access of freed memory like bat_priv structures.

Detection Guidance

This vulnerability is specific to the Linux kernel's batman-adv module and involves a memory leak in the BLA (Bridge Loop Avoidance) component. Detection requires checking for kernel logs or system crashes related to batman-adv module failures. Commands like dmesg | grep batman-adv or journalctl -k | grep batman-adv may help identify issues. Ensure your kernel version includes the fix for CVE-2026-64218.

Impact Analysis

This vulnerability could cause system instability or crashes if exploited. It may lead to memory corruption, kernel panics, or privilege escalation in systems running vulnerable Linux kernel versions with batman-adv enabled. Systems using mesh networking with BLA could experience unexpected behavior or security issues.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA. It is a memory management issue in the Linux kernel's batman-adv module that could lead to use-after-free errors or memory corruption during network operations. Such low-level issues may indirectly impact system stability and security, but no specific compliance implications are mentioned in the provided context.

Mitigation Strategies

Update your Linux kernel to a version that includes the fix for CVE-2026-64218. If using a distribution kernel, apply the latest security patches. For custom kernels, recompile with the patched batman-adv module. Restart affected systems to load the updated kernel.

Hi! I’m here to help you understand CVE-2026-64218. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70