CVE-2026-64093

CVE CVE-2026-64093EUVD EUVD-2026-45778Published 2026-07-19T15:40:01.000ZLast changed 2026-08-05T12:39:08.000ZCVSS 8.8

What the advisory describes

In the Linux kernel, the following vulnerability has been resolved: batman-adv: tp_meter: directly shut down timer on cleanup batadv_tp_sender_cleanup() was calling timer_delete_sync() followed by timer_delete() to guard against the timer handler re-arming itself between the two calls. This double-deletion hack relied on the sending status being set to 0 to suppress re-arming. Replace both calls with a single timer_shutdown_sync(). This function both waits for any running timer callback to complete (like timer_delete_sync()) and permanently disarms the timer so it cannot be re-armed afterwards, making re-arming prevention unconditional and self-documenting. The re-arming property is also required because otherwise: 1. context 0 (batadv_tp_recv_ack()) checks in batadv_tp_reset_sender_timer() if sending is still 1 -> it is 2. context 1 changes in batadv_tp_sender_shutdown() sending to 0 and in this process forces the kthread to stop timer in batadv_tp_sender_cleanup() 3. context 0 continues in batadv_tp_reset_sender_timer() and rearms the timer -> but the reference for it is already gone

Source: EUVD (ENISA), in the words of the advisory.

Products the advisory names

These come from the advisory itself, not from any check we performed.

Linux — Linux patch: 6.1.176; 33a3bb4a3345bb511f9c69c913da95d4693e2a4e <74a76634055462833446684fd526d73c290ea43a; patch: 6.12.93; patch: 5.15.210; 33a3bb4a3345bb511f9c69c913da95d4693e2a4e <933880a8bc9b4042223a79255c0b1021cdc36991; patch: 7.0.11; 33a3bb4a3345bb511f9c69c913da95d4693e2a4e <f86b20ec8d17d77bddc02c5c86cfa2389d84ecff; patch: 6.18.34; 33a3bb4a3345bb511f9c69c913da95d4693e2a4e <d5487249a81ea658717614009c8f46acc5b7101a; 4.8; patch: 0; patch: 7.1; patch: 6.6.143; 33a3bb4a3345bb511f9c69c913da95d4693e2a4e <770bf0a35f0620b526fd4193889d1e77084e4c43; 33a3bb4a3345bb511f9c69c913da95d4693e2a4e <5bc2d50fb66b46f86543d5153a188eb1486d0b6e; 33a3bb4a3345bb511f9c69c913da95d4693e2a4e <00bf4bb9947b1190a8be8d9b6a1bcbfa3707785c

The versions shown are the advisory's own. Patchlage compares no version numbers and derives no judgement from them — which version is installed is something a person has to look up.

Carried in the product catalogue

An estate covering these products can be recorded in Patchlage. An advisory about them appears in the next morning's situation report.

Linux — Linux

Does this concern one of your customers?

This page cannot answer that — it does not know your estate. Whoever has recorded their environments gets the answer the morning after publication, together with a paragraph they can forward to the customer unedited.

Try it for 28 days

Patchlage reports hits and suspected hits. About everything else this system says nothing — neither this page nor the situation report ever claims that an estate is safe.