CVE-2026-64094: Linux Kernel Use-After-Free Vulnerability

CVE-2026-64094 Overview

CVE-2026-64094 is a NULL pointer dereference vulnerability in the Linux kernel's batman-adv (B.A.T.M.A.N. Advanced) mesh networking module. The flaw exists in the Bridge Loop Avoidance (BLA) subsystem, where a hardware interface (hardif) can be retrieved as the primary interface of a mesh interface (meshif) without holding rtnl_lock. During concurrent operations, the hardware interface can be decoupled from the mesh interface, leaving the pointer from the primary hardware interface to the mesh interface set to NULL. Subsequent code paths that attempt to send an Address Resolution Protocol (ARP) request through the mesh interface trigger a NULL pointer dereference, resulting in a kernel crash.

Critical Impact
Local attackers with the ability to trigger interface reconfiguration on systems running batman-adv mesh networking can cause kernel panics, leading to denial of service.

Affected Products

Linux kernel batman-adv module (mesh networking)
Multiple stable kernel branches referenced in upstream patch commits
Systems configured with B.A.T.M.A.N. Advanced mesh routing

Discovery Timeline

2026-07-19 - CVE-2026-64094 published to NVD
2026-07-19 - Last updated in NVD database

Technical Details for CVE-2026-64094

Vulnerability Analysis

The vulnerability resides in the batman-adv Bridge Loop Avoidance code path responsible for issuing ARP claim messages. When the module retrieves a hardware interface as the primary interface of a mesh interface, it does so without holding the RTNL (Routing Netlink) lock. This absence of synchronization creates a race window during which the hardware interface can be detached from its parent mesh interface.

Once detachment occurs, the mesh_iface pointer on the primary hardware interface is set to NULL. Subsequent operations that assumed the pointer would remain valid then dereference NULL, causing a kernel oops. The upstream fix adds a NULL check on mesh_iface before continuing to send an ARP request through the mesh interface.

Root Cause

The root cause is missing synchronization between the batman-adv BLA claim path and interface teardown operations. Because rtnl_lock is not held while accessing the primary hardware interface, the interface state can change mid-operation. This is a classic time-of-check to time-of-use (TOCTOU) pattern combined with a missing NULL guard on mesh_iface.

Attack Vector

Triggering the flaw requires the ability to add and remove hardware interfaces bound to a batman-adv mesh interface while claim traffic is being generated. On multi-tenant or containerized systems where users can manipulate network interfaces, this can be induced locally. Remote exploitation is unlikely without prior local access to interface configuration. The impact is limited to denial of service through kernel crash; no memory corruption or privilege escalation vectors have been reported.

The upstream patches 0f3ebd7b, 2a8c9e86, 4f626673, 53cb3511, 555b8d3f, 6921a768, efb62458, and f80d3d98 add the required NULL check.

Detection Methods for CVE-2026-64094

Indicators of Compromise

Kernel oops or panic entries in dmesg referencing batadv_bla_send_claim or related batman-adv functions.
NULL pointer dereference traces originating from the batman-adv module during ARP handling.
Unexpected mesh interface teardown events correlated in time with hardware interface removal.

Detection Strategies

Monitor kernel ring buffers for stack traces containing batman-adv symbols and NULL pointer messages.
Correlate RTM_DELLINK and RTM_NEWLINK netlink events with kernel crash telemetry on affected hosts.
Track running kernel versions across the fleet and flag hosts without the upstream stable patches applied.

Monitoring Recommendations

Ingest /var/log/kern.log and journalctl -k output into a centralized log platform for pattern matching on batman-adv faults.
Enable kdump on production nodes to capture crash dumps for post-mortem analysis.
Alert on repeated node reboots or unexpected mesh network partitioning that could indicate exploitation attempts.

How to Mitigate CVE-2026-64094

Immediate Actions Required

Update to a Linux kernel build that includes the referenced upstream stable commits fixing the batman-adv BLA NULL pointer dereference.
Restrict the ability of non-privileged users and containers to modify network interfaces attached to batman-adv mesh interfaces.
On systems that do not require mesh networking, unload the batman_adv module and blacklist it.

Patch Information

The fix adds a NULL check on mesh_iface before continuing to send an ARP request via the mesh interface. Apply the vendor-provided kernel update corresponding to your distribution. Reference commits are available on git.kernel.org including 0f3ebd7b, 2a8c9e86, and f80d3d98.

Workarounds

Disable Bridge Loop Avoidance on batman-adv mesh interfaces where it is not required.
Avoid dynamic addition and removal of hardware interfaces from active mesh interfaces during production workloads.
Blacklist the batman_adv kernel module on hosts that do not use mesh networking.

bash

# Blacklist batman-adv on systems that do not require mesh networking
echo "blacklist batman_adv" | sudo tee /etc/modprobe.d/blacklist-batman-adv.conf
sudo modprobe -r batman_adv

# Verify current kernel version to confirm patch level
uname -r

# Disable Bridge Loop Avoidance on an existing mesh interface (if BLA is not required)
sudo batctl meshif bat0 bridge_loop_avoidance disable