CVE-2026-64092

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

batman-adv: tp_meter: fix tp_vars reference leak in receiver shutdown

The receiver shutdown timer handler, batadv_tp_receiver_shutdown(), is

responsible for releasing the tp_vars reference it holds. However, the

existing logic for coordinating this release with batadv_tp_stop_all() was

flawed.

timer_shutdown_sync() guarantees the timer will not fire again after it

returns, but it returns non-zero only when the timer was pending at the

time of the call. If the timer had already expired (and

batadv_tp_stop_all() would unsucessfully try to rearm itself),

batadv_tp_stop_all() skips its batadv_tp_vars_put(), and

batadv_tp_receiver_shutdown() fails to put its own reference as well.

Fix this by introducing a new atomic variable receiving that is set to 1

when the receiver is initialized and cleared atomically with atomic_xchg()

by whichever side claims it first. Only the side that observes the

transition from 1 to 0 is r

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References