CVE-2026-64091: Linux Kernel Race Condition Vulnerability

CVE-2026-64091 Overview

CVE-2026-64091 is a Time-of-Check Time-of-Use (TOCTOU) race condition in the Linux kernel's batman-adv mesh networking module. The flaw resides in the translation table (TT) TVLV generation logic, where the buffer size is calculated based on the number of VLANs containing at least one TT entry. Between the size calculation and buffer population, additional VLANs can transition from empty to non-empty state. This mismatch causes VLAN entries to be written beyond the allocated buffer boundary, corrupting adjacent kernel memory.

Critical Impact
The race condition allows out-of-bounds writes in kernel memory, potentially leading to memory corruption, denial of service, or privilege escalation on systems using batman-adv mesh networking.

Affected Products

Linux kernel versions containing the vulnerable batman-adv translation table implementation
Systems deploying B.A.T.M.A.N. Advanced mesh networking
Linux distributions bundling affected upstream kernel releases

Discovery Timeline

2026-07-19 - CVE-2026-64091 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-64091

Vulnerability Analysis

The batman-adv module generates a local TT-based TVLV (Type-Length-Value Variable) structure that reports VLAN membership to mesh peers. The generation process operates in two phases: first, the code counts VLANs containing at least one TT entry; second, it allocates a buffer sized for that count and populates it with VLAN entries.

The meshif_vlan_list_lock protects the VLAN list during buffer population, preventing VLANs from being added or removed. However, the lock does not synchronize modifications to per-VLAN TT entry counts. A VLAN that reported zero entries during the prefilter check can gain entries before population begins.

When this occurs, the loop iterates over more non-empty VLANs than the allocated buffer can hold. The kernel then writes VLAN entry data past the buffer boundary, corrupting heap-adjacent kernel structures.

Root Cause

The root cause is inconsistent synchronization between the size-calculation phase and the buffer-population phase [CWE-367]. The prefilter check reads VLAN state without holding a lock that also protects TT entry counts, breaking the invariant that the two phases observe identical state.

Attack Vector

The attack requires the ability to trigger TT entry additions on VLANs that appear empty during the size calculation window. On mesh networks, this state can be influenced by network traffic patterns, since TT entries reflect observed client MAC addresses per VLAN. The upstream fix overestimates the buffer size and populates only non-empty VLANs, eliminating the TOCTOU window.

No public proof-of-concept exploit has been published. See the kernel commit series for the corrective patches.

Detection Methods for CVE-2026-64091

Indicators of Compromise

Unexplained kernel oops or panic messages referencing batadv_tt_tvlv_container_update or related translation table functions
KASAN reports indicating slab-out-of-bounds writes originating in batman-adv
Node instability or crashes on mesh gateway systems under high VLAN churn

Detection Strategies

Enable KASAN on kernels running batman-adv to catch out-of-bounds writes in test environments
Monitor kernel ring buffer output for stack traces containing batadv_ symbols followed by memory corruption warnings
Inventory hosts running the batman-adv module using lsmod | grep batman_adv and correlate against patched kernel versions

Monitoring Recommendations

Collect kernel logs centrally and alert on batman-adv warnings, oops entries, or slab corruption reports
Track kernel package versions across mesh nodes and flag hosts running unpatched builds
Baseline mesh network VLAN churn rates and investigate abnormal spikes that could trigger the race

How to Mitigate CVE-2026-64091

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the CVE record and reboot affected mesh nodes
Identify all systems loading the batman-adv module and prioritize gateways and multi-VLAN nodes
If patching cannot be scheduled immediately, unload batman-adv on hosts that do not require mesh networking

Patch Information

The fix has been merged across multiple stable branches. Reference commits include 211ea599, 4cc85aec, 65a1e673, 724a8eb4, 94d27005, 9a9c8594, b4d4efd4, and e4236bf3. The corrected logic overestimates the buffer size during allocation and skips empty VLANs during population, eliminating the TOCTOU window. See Kernel Commit 211ea59 for the primary fix.

Workarounds

Unload the batman-adv kernel module on systems that do not require B.A.T.M.A.N. mesh functionality
Reduce VLAN churn on mesh nodes by stabilizing client MAC address rotation and DHCP lease turnover
Restrict local access to mesh interfaces to prevent adversarial VLAN state manipulation

bash

# Check if batman-adv is loaded and unload if unused
lsmod | grep batman_adv
sudo modprobe -r batman_adv

# Blacklist the module to prevent auto-load
echo "blacklist batman-adv" | sudo tee /etc/modprobe.d/blacklist-batman-adv.conf
sudo update-initramfs -u