CVE-2026-64090: Linux Kernel batman-adv TT Vulnerability

CVE-2026-64090 Overview

CVE-2026-64090 affects the Linux kernel's batman-adv (B.A.T.M.A.N. Advanced) mesh networking module. The vulnerability resides in the Translation Table (TT) subsystem, where the module can send empty VLAN responses when replying to TT requests from the global TT state. This inconsistency was partially addressed in an earlier fix (commit 16116dac2339), which only covered the local direct TT response path. Indirect responses served by other mesh nodes using global TT state remained affected, allowing inconsistent TT TLVs to propagate across the mesh.

Critical Impact
Inconsistent Translation Table state can trigger TT request storms across batman-adv mesh networks, degrading availability of mesh routing infrastructure.

Affected Products

Linux kernel with batman-adv mesh networking module enabled
Systems using B.A.T.M.A.N. Advanced routing protocol
Mesh networking deployments relying on kernel-based batman-adv

Discovery Timeline

2026-07-19 - CVE-2026-64090 published to NVD
2026-07-19 - Last updated in NVD database

Technical Details for CVE-2026-64090

Vulnerability Analysis

The batman-adv module maintains a Translation Table (TT) that maps client MAC addresses to originator nodes across the mesh. When a node requests TT information, another node can serve the reply either directly from its local TT or indirectly using its cached global TT state. A prior fix in commit 16116dac2339 ("batman-adv: prevent TT request storms by not sending inconsistent TT TLVLs") added consistency checks only to the local response code path.

The indirect response path, which uses global TT state maintained by other mesh nodes, was not covered by that fix. As a result, nodes could still transmit replies containing empty VLAN TLVs. Peers receiving these inconsistent responses reject the payload and reissue TT requests, producing the request storm condition the original patch aimed to prevent.

Root Cause

The root cause is incomplete input validation on outbound TT response messages. The global TT reply builder did not filter out VLAN entries containing no client data before serializing the TLV structure. Empty VLAN TLVs violate the protocol expectations of receiving nodes, which use the TT CRC to detect state inconsistency.

Attack Vector

Exploitation requires participation in or adjacency to a batman-adv mesh network. A node advertising sparse or empty VLAN state can cause other mesh participants to generate malformed indirect TT responses, amplifying request traffic across the mesh. This is a network-adjacent availability issue rather than a memory safety or code execution flaw.

No verified exploitation code is available. Refer to the upstream kernel commits for technical details of the fix: Kernel Commit 1f467d9, Kernel Commit 9a02c8f, and Kernel Commit ea4f757.

Detection Methods for CVE-2026-64090

Indicators of Compromise

Elevated volumes of BATADV_TT_REQUEST and BATADV_TT_RESPONSE packets on mesh interfaces
Repeated TT CRC mismatch log entries from batman-adv kernel messages
Sudden growth in mesh control-plane traffic without corresponding data-plane changes
Mesh nodes reporting inconsistent client-to-originator mappings

Detection Strategies

Monitor dmesg and journalctl -k output for batman-adv warnings referencing TT inconsistency or CRC mismatches
Capture mesh traffic with tcpdump on the batman-adv interface and inspect TT TLV payloads for empty VLAN entries
Baseline TT request rates per node and alert on statistical deviations

Monitoring Recommendations

Track kernel version inventory across mesh nodes to identify unpatched systems
Enable batman-adv debug logging (batctl loglevel) in test environments to validate patch behavior
Correlate mesh control traffic spikes with node join, leave, or VLAN configuration changes

How to Mitigate CVE-2026-64090

Immediate Actions Required

Update the Linux kernel to a stable release containing the fix commits referenced in the NVD entry
Inventory all systems running batman-adv and prioritize patching mesh gateway and relay nodes
Restrict mesh membership to trusted nodes where feasible, using authentication or physical layer controls

Patch Information

The fix is distributed across multiple stable kernel branches. Apply the appropriate commit for your kernel series: Kernel Commit 1f467d9, Kernel Commit 99f17d1, Kernel Commit 9a02c8f, Kernel Commit ab26e34, Kernel Commit b93ca60, Kernel Commit cfb3064, Kernel Commit ea4f757, and Kernel Commit fa1bd70.

Workarounds

Disable the batman-adv kernel module on systems that do not require mesh routing using modprobe -r batman_adv
Segment untrusted mesh participants onto isolated interfaces to limit blast radius of malformed TT traffic
Where possible, avoid configuring VLANs on batman-adv soft interfaces until patched kernels are deployed

bash

# Verify kernel version and batman-adv module status
uname -r
modinfo batman_adv | grep -E 'version|filename'

# Temporarily remove the module if mesh routing is not required
sudo modprobe -r batman_adv

# Blacklist to prevent automatic loading until patched
echo 'blacklist batman_adv' | sudo tee /etc/modprobe.d/batman-adv-blacklist.conf