CVE-2026-64092 Overview
CVE-2026-64092 is a reference count leak vulnerability in the Linux kernel's batman-adv (B.A.T.M.A.N. Advanced) mesh networking module. The flaw resides in the throughput meter (tp_meter) subsystem, specifically in the receiver shutdown coordination logic between batadv_tp_receiver_shutdown() and batadv_tp_stop_all(). When the shutdown timer has already expired, both code paths skip the required batadv_tp_vars_put() call, leaking the tp_vars reference. The vulnerability was resolved through kernel commits that introduce an atomic receiving variable to deterministically assign release responsibility using atomic_xchg().
Critical Impact
Repeated triggering of the throughput meter receiver shutdown path leaks tp_vars structure references, resulting in memory leaks that can lead to resource exhaustion on affected kernels.
Affected Products
- Linux kernel versions containing the batman-adv mesh networking module with the flawed tp_meter shutdown coordination
- Distributions shipping vulnerable Linux kernel builds
- Mesh networking deployments using batman-adv throughput measurement
Discovery Timeline
- 2026-07-19 - CVE-2026-64092 published to NVD
- 2026-07-19 - Last updated in NVD database
Technical Details for CVE-2026-64092
Vulnerability Analysis
The vulnerability exists in the batman-adv throughput meter subsystem within the Linux kernel networking stack. The receiver shutdown timer handler batadv_tp_receiver_shutdown() owns a reference to the tp_vars structure and must release it during shutdown. Coordination with batadv_tp_stop_all() determines which code path performs the release.
The pre-patch logic relied on the return value of timer_shutdown_sync(). This function guarantees the timer will not fire again after returning, but only returns a non-zero value when the timer was pending at the time of the call. If the timer had already expired, batadv_tp_stop_all() would unsuccessfully attempt to rearm and then skip its batadv_tp_vars_put() call. The already-expired handler batadv_tp_receiver_shutdown() likewise failed to release its own reference, leaving the tp_vars object leaked.
Root Cause
The root cause is a race condition and ownership ambiguity between the timer handler and the stop path. Neither side could reliably determine which was responsible for calling batadv_tp_vars_put() when the timer had already expired. This is a classic reference counting coordination flaw between concurrent kernel execution contexts.
Attack Vector
The vulnerability requires interaction with the batman-adv throughput meter functionality. Repeated invocation of receiver shutdown paths under conditions where the timer has expired causes cumulative tp_vars reference leaks. Over time, this leads to kernel memory exhaustion in systems using batman-adv mesh networking.
The fix introduces a new atomic variable receiving, initialized to 1 when the receiver starts. The path that observes the atomic transition from 1 to 0 via atomic_xchg() takes exclusive responsibility for releasing the tp_vars reference, eliminating the ambiguity.
Detection Methods for CVE-2026-64092
Indicators of Compromise
- Gradual increase in kernel slab allocations associated with batman-adv structures over the lifetime of the system
- Unexplained memory pressure on systems configured to run batman-adv mesh interfaces with active throughput measurement
- Kernel warnings related to tp_vars lifecycle when kernel debug options such as CONFIG_DEBUG_KMEMLEAK are enabled
Detection Strategies
- Enumerate running kernel versions across the fleet and cross-reference against the fixed commits listed in the git.kernel.org references
- Enable kmemleak on test kernels to identify leaked tp_vars allocations during batman-adv receiver shutdown scenarios
- Monitor /proc/slabinfo on nodes running batman-adv for unbounded growth of related caches
Monitoring Recommendations
- Track kernel memory consumption trends on mesh gateways and edge devices that load the batman_adv module
- Alert on repeated batadv_tp_meter stop and shutdown events in kernel logs
- Include kernel version and loaded module inventory in endpoint telemetry to identify unpatched hosts
How to Mitigate CVE-2026-64092
Immediate Actions Required
- Apply the upstream Linux kernel patches referenced by the stable tree commits 0b1bedf114ea, 297e1bc4a915, 77098e4bea37, 7715c73f3326, a9f0bfd624ee, b285bc0a97f4, and d078501dde9b
- Update to distribution kernels that incorporate the batman-adv: tp_meter: fix tp_vars reference leak in receiver shutdown fix
- Prioritize patching on systems that actively use batman-adv mesh networking
Patch Information
The fix is available across multiple stable branches via the kernel.org stable tree. Refer to the Kernel Git Commit Update 1, Kernel Git Commit Update 2, Kernel Git Commit Update 3, Kernel Git Commit Update 4, Kernel Git Commit Update 5, Kernel Git Commit Update 6, and Kernel Git Commit Update 7. The patch introduces an atomic receiving flag cleared via atomic_xchg() to deterministically assign responsibility for batadv_tp_vars_put().
Workarounds
- Unload the batman_adv kernel module on systems that do not require mesh networking using modprobe -r batman_adv
- Blacklist the batman_adv module in /etc/modprobe.d/ where mesh functionality is not needed
- Restrict access to batman-adv control interfaces to trusted local users and management systems only
- Schedule reboots for long-running mesh nodes to reclaim leaked kernel memory until patches are applied
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
