CVE-2026-64093: Linux Kernel Privilege Escalation Flaw

CVE-2026-64093 Overview

CVE-2026-64093 is a race condition vulnerability in the Linux kernel's batman-adv (B.A.T.M.A.N. Advanced) mesh networking module, specifically within the throughput meter (tp_meter) subsystem. The flaw exists in batadv_tp_sender_cleanup(), which previously used a timer_delete_sync() followed by timer_delete() sequence to prevent the timer handler from re-arming itself between calls. Under specific concurrency conditions, the timer could still be re-armed after the reference was released, leading to use-after-free style behavior on kernel timer structures.

Critical Impact
An adjacent-network attacker who can trigger throughput meter operations on a batman-adv mesh interface may exploit the timer race to corrupt kernel state, resulting in denial of service or potential memory corruption impacting confidentiality, integrity, and availability.

Affected Products

Linux kernel versions containing the batman-adv module prior to the fix commits referenced in stable trees
Systems using B.A.T.M.A.N. Advanced mesh networking with tp_meter enabled
Linux distributions shipping affected stable and longterm kernel branches

Discovery Timeline

2026-07-19 - CVE-2026-64093 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-64093

Vulnerability Analysis

The vulnerability resides in the batman-adv throughput meter cleanup logic. The original batadv_tp_sender_cleanup() function attempted to disarm a repeating kernel timer using timer_delete_sync() immediately followed by timer_delete(). This double-deletion pattern relied on the sender's sending flag being reset to 0 to suppress subsequent re-arming inside batadv_tp_reset_sender_timer().

The defect is exposed through a three-context interleaving. In context 0, batadv_tp_recv_ack() checks in batadv_tp_reset_sender_timer() whether sending is still 1 and observes that it is. In context 1, batadv_tp_sender_shutdown() clears sending to 0 and forces the kthread to stop the timer via batadv_tp_sender_cleanup(). Context 0 then continues and re-arms the timer, even though its backing reference has already been released.

The fix replaces both deletion calls with a single timer_shutdown_sync(), which both waits for any running callback to complete and permanently disarms the timer so it cannot be re-armed. This makes re-arming prevention unconditional rather than conditional on cooperating flag state.

Root Cause

The root cause is an unsafe timer teardown sequence combined with a TOCTOU (Time-of-Check Time-of-Use) window between the sending flag check and the timer re-arm operation. The cleanup path assumed that clearing the flag before deleting the timer would prevent concurrent re-arming, but the ACK receive path could sample the flag before it was cleared and then re-arm the timer after cleanup released the associated reference.

Attack Vector

Exploitation requires the ability to send traffic on an adjacent network segment participating in a batman-adv mesh, and to trigger throughput meter operations that produce concurrent ACK processing and sender shutdown paths. No authentication or user interaction is required. The vulnerability manifests as kernel memory corruption on a freed timer structure, which can lead to denial of service or potential further kernel-level compromise. See the upstream fix at kernel.org commit 74a76634 for technical details.

Detection Methods for CVE-2026-64093

Indicators of Compromise

Kernel oops or panic entries referencing batadv_tp_sender_timer, batadv_tp_sender_cleanup, or batadv_tp_reset_sender_timer in dmesg or /var/log/kern.log
Unexpected reboots or soft lockups on hosts acting as batman-adv mesh nodes with tp_meter activity
Anomalous throughput meter sessions initiated from unknown mesh peers on the bat0 interface

Detection Strategies

Monitor kernel ring buffers for stack traces containing batman-adv timer symbols and correlate with mesh interface activity
Inventory hosts loading the batman_adv module using lsmod and cross-reference against the running kernel version
Alert on repeated tp_meter invocations from adjacent nodes that do not match normal operational baselines

Monitoring Recommendations

Forward kernel logs from mesh-participating endpoints to a centralized log platform for correlation of crash signatures
Track kernel package versions across the fleet and flag hosts running kernels predating the timer_shutdown_sync() fix
Baseline expected batman-adv peers and generate alerts on unexpected neighbor announcements on the mesh link layer

How to Mitigate CVE-2026-64093

Immediate Actions Required

Apply the vendor-supplied kernel update containing the batman-adv: tp_meter: directly shut down timer on cleanup patch as soon as a maintenance window allows
Identify all hosts with the batman_adv kernel module loaded and prioritize them for patching
Restrict physical and layer-2 access to network segments carrying batman-adv traffic to trusted devices only

Patch Information

The upstream fix replaces the timer_delete_sync() plus timer_delete() sequence with timer_shutdown_sync() in batadv_tp_sender_cleanup(). Backports have been merged across multiple stable branches. Refer to the following commits: 00bf4bb9, 5bc2d50f, 74a76634, 770bf0a3, 933880a8, d5487249, and f86b20ec.

Workarounds

Unload the batman_adv module on systems that do not require mesh networking using modprobe -r batman_adv and blacklist it to prevent auto-load
Disable or avoid using the batctl tp throughput meter command on unpatched hosts to reduce the likelihood of triggering the cleanup path
Segment batman-adv mesh interfaces onto isolated VLANs or physical links accessible only to trusted mesh participants

bash

# Configuration example: disable batman-adv on unpatched hosts
sudo modprobe -r batman_adv
echo 'blacklist batman_adv' | sudo tee /etc/modprobe.d/blacklist-batman-adv.conf
sudo update-initramfs -u