CVE-2026-64095: Linux Kernel Race Condition Vulnerability

CVE-2026-64095 Overview

CVE-2026-64095 is a race condition vulnerability in the Linux kernel's batman-adv module, specifically in the Bridge Loop Avoidance (BLA) subsystem. The flaw stems from non-atomic access to bla.num_requests and the associated request_sent state variable. Concurrent execution paths can trigger a double decrement of the counter, corrupting internal state of the mesh networking module.

The vulnerability affects systems running the batman-adv mesh routing protocol over adjacent network interfaces. Attackers on the same layer-2 network segment can trigger the race condition to cause kernel state corruption and denial of service.

Critical Impact
An adjacent-network attacker can trigger concurrent code paths in batadv_bla_send_request() and batadv_handle_announce() to corrupt reference counters, leading to potential kernel instability and denial of service on mesh network nodes.

Affected Products

Linux kernel with batman-adv (Better Approach To Mobile Ad-hoc Networking - Advanced) module enabled
Linux distributions shipping affected stable kernel branches (fixed via commits 1f013bc, 4538461, 461f1e3, 5328b95, 65497ad, 83ab69b, 8ff9c59, a939375)
Mesh networking deployments using batman-adv Bridge Loop Avoidance

Discovery Timeline

2026-07-19 - CVE-2026-64095 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-64095

Vulnerability Analysis

The vulnerability resides in the Bridge Loop Avoidance (BLA) component of the batman-adv mesh networking module. The bla.num_requests counter tracks outstanding request messages sent when a backbone gateway is discovered. This counter is incremented in batadv_bla_send_request() when no request_sent state is currently in progress, and decremented in multiple paths including announcement handling, backbone purge operations, and periodic work queues.

The root problem is a Time-of-Check to Time-of-Use (TOCTOU) race condition. The check on request_sent and the atomic increment or decrement of num_requests are performed as separate operations without a common lock. Multiple kernel contexts running concurrently on different CPUs can observe stale state and perform unbalanced counter modifications.

Root Cause

The root cause is missing atomicity between the state check and the counter modification. Specifically, batadv_bla_send_request() may set request_sent to 1 and be preempted before it can increment num_requests. Concurrently, batadv_handle_announce() can reset request_sent to 0 and decrement num_requests before it was ever incremented. This produces a double decrement pattern that corrupts the counter.

Additionally, the absence of a distinct "stopped" state means a parallel context holding a valid backbone_gw reference can continue to touch bla.num_requests after batadv_bla_purge_backbone_gw() has begun cleanup. The fix introduces a lock protecting both fields and adds a third explicit state to signal that a backbone gateway is being cleaned up.

Attack Vector

Exploitation requires adjacent network access. An attacker on the same layer-2 broadcast domain as a batman-adv node can inject crafted mesh frames, including forged backbone announcements, to trigger concurrent execution of batadv_bla_send_request() and batadv_handle_announce(). Repeated triggering of the race window corrupts BLA reference counting and can lead to availability loss on the mesh node. No authentication or user interaction is required.

The vulnerability affects the integrity of internal kernel state and the availability of the mesh networking subsystem. See the upstream commits linked in the references for technical details of the fix.

Detection Methods for CVE-2026-64095

Indicators of Compromise

Unexpected kernel log entries from the batman-adv module referencing BLA state transitions or reference count anomalies
Mesh network instability, dropped backbone gateway associations, or persistent request-sent states on affected nodes
Elevated volume of BLA announcement or claim frames originating from a single adjacent host

Detection Strategies

Audit running kernel version against the fixed stable branches listed in the kernel.org commit references
Monitor dmesg and journalctl -k output for batman-adv warnings, BUG_ON, or soft lockup traces originating in net/batman-adv/bridge_loop_avoidance.c
Inspect layer-2 traffic on mesh interfaces for anomalous batman-adv frame patterns using packet capture tools

Monitoring Recommendations

Forward kernel logs from mesh nodes to a centralized logging platform and alert on batman-adv error strings
Track kernel version inventory across Linux hosts running mesh workloads to identify unpatched systems
Establish baselines for BLA announcement rates and alert on statistical deviations that may indicate a triggering attempt

How to Mitigate CVE-2026-64095

Immediate Actions Required

Update to a Linux kernel version that includes the upstream fix from one of the referenced stable commits
Identify all hosts loading the batman_adv module using lsmod | grep batman and prioritize patching those systems
Restrict physical and wireless access to layer-2 segments where batman-adv is in use to limit adjacent-network exposure

Patch Information

The fix is available in the upstream Linux stable tree. Relevant commits include Kernel Git Commit 1f013bc, Kernel Git Commit 4538461, Kernel Git Commit 461f1e3, Kernel Git Commit 5328b95, Kernel Git Commit 65497ad, Kernel Git Commit 83ab69b, Kernel Git Commit 8ff9c59, and Kernel Git Commit a939375. The patch introduces a lock covering both request_sent and bla.num_requests and adds a third "stopped" state to safely signal backbone gateway cleanup.

Workarounds

Unload the batman_adv kernel module on systems that do not require mesh networking using modprobe -r batman_adv
Blacklist the module by adding blacklist batman_adv to /etc/modprobe.d/blacklist-batman.conf on non-mesh nodes
Segment mesh networks from untrusted layer-2 domains and enforce MAC filtering on wireless access points feeding the mesh

bash

# Verify batman-adv module status and blacklist if unused
lsmod | grep batman_adv
sudo modprobe -r batman_adv
echo "blacklist batman_adv" | sudo tee /etc/modprobe.d/blacklist-batman.conf

# Check running kernel version against fixed stable branches
uname -r