CVE-2026-64095

CVE CVE-2026-64095EUVD EUVD-2026-45780Published 2026-07-19T15:40:02.000ZLast changed 2026-08-05T12:39:09.000ZCVSS 7.1

What the advisory describes

In the Linux kernel, the following vulnerability has been resolved: batman-adv: bla: avoid double decrement of bla.num_requests The bla.num_requests is increased when no request_sent was in progress. And it is decremented in various places (announcement was received, backbone is purged, periodic work). But the check if the request_sent is actually set to a specific state and the atomic_dec/_inc are not safe because they are not atomic (TOCTOU) and multiple such code portions can run concurrently. At the same time, it is necessary to modify request_sent (state) and bla.num_requests atomically. Otherwise batadv_bla_send_request() might set request_sent to 1 and is interrupted. batadv_handle_announce() can then set request_sent back to 0 and decrement num_requests before batadv_bla_send_request() incremented it. The two operations must therefore be locked. And since state (request_sent) and wait_periods are only accessed inside this lock, they can be converted to simpler datatypes. And to avoid that the bla.num_requests is touched by a parallel running context with a valid backbone_gw reference after batadv_bla_purge_backbone_gw() ran, a third state "stopped" is required to correctly signal that a backbone_gw is in the state of being cleaned up.

Source: EUVD (ENISA), in the words of the advisory.

Products the advisory names

These come from the advisory itself, not from any check we performed.

• Linux — Linux patch: 0; 3.5; 23721387c409087fd3b97e274f34d3ddc0970b74 <45384612f29692fbf0c770200361a7acff90125c; patch: 7.1; 23721387c409087fd3b97e274f34d3ddc0970b74 <83ab69bd12b80f6ea169c8bea6977701b53a043d; 23721387c409087fd3b97e274f34d3ddc0970b74 <461f1e3dfb888701895b766446c55db2b10db705; 23721387c409087fd3b97e274f34d3ddc0970b74 <1f013bc94154f2e78e97d0296175664224c796e0; patch: 6.1.176; patch: 6.12.93; patch: 5.15.210; patch: 6.6.143; 23721387c409087fd3b97e274f34d3ddc0970b74 <65497ad155a3246df177b5ef662cd6e5a32cb470; patch: 7.0.11; 23721387c409087fd3b97e274f34d3ddc0970b74 <5328b95960774f2e189f22485616bc7b8eb2f7e3; patch: 6.18.34; patch: 5.10.259; 23721387c409087fd3b97e274f34d3ddc0970b74 <a9393751ecf7e9096f93cb6eed02db4f79125765; 23721387c409087fd3b97e274f34d3ddc0970b74 <8ff9c59d1b7b48c2596878341a5310f32895d52b

The versions shown are the advisory's own. Patchlage compares no version numbers and derives no judgement from them — which version is installed is something a person has to look up.

Carried in the product catalogue

An estate covering these products can be recorded in Patchlage. An advisory about them appears in the next morning's situation report.

• Linux — Linux

Patchlage reports hits and suspected hits. About everything else this system says nothing — neither this page nor the situation report ever claims that an estate is safe.