CVE-2026-64096: Linux Kernel Use-After-Free Vulnerability

CVE-2026-64096 Overview

CVE-2026-64096 is a use-after-free vulnerability in the Linux kernel's batman-adv multicast subsystem. The flaw resides in batadv_mcast_purge_orig(), which removes entries from Read-Copy-Update (RCU) protected hash lists without waiting for an RCU grace period. Concurrent RCU readers can still hold references to entries such as orig->mcast_want_all_ipv6_node at the moment of removal, causing them to dereference freed memory. An attacker on the adjacent network segment running a batman-adv mesh can trigger this race to corrupt kernel memory. The vulnerability affects confidentiality, integrity, and availability on hosts participating in a batman-adv mesh network.

Critical Impact
Adjacent-network attackers can trigger a kernel use-after-free in the batman-adv multicast code path, enabling potential memory corruption, kernel crash, or privilege escalation on affected Linux hosts.

Affected Products

Linux kernel with batman-adv (Better Approach To Mobile Ad-hoc Networking) module enabled
Multiple stable branches referenced by upstream kernel commits
Mesh networking deployments using batman-adv multicast routing

Discovery Timeline

2026-07-19 - CVE-2026-64096 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-64096

Vulnerability Analysis

The vulnerability affects the batman-adv (B.A.T.M.A.N. Advanced) kernel module, which implements Layer 2 mesh routing. When an orig_node structure is released, batadv_mcast_purge_orig() walks RCU-protected hlists and removes multicast tracking entries. The function returns immediately after removal, without invoking synchronize_rcu() or scheduling a call_rcu() callback for the purged entries.

Concurrent readers traversing the same hlists under rcu_read_lock() may still hold pointers to structures such as orig->mcast_want_all_ipv6_node. Once the enclosing orig_node memory is reclaimed, those readers dereference freed kernel memory. This is a classic use-after-free condition [CWE-416] rooted in incorrect RCU synchronization semantics.

Root Cause

The root cause is a missing RCU grace period between hlist removal and memory reclamation. The purge routine assumed synchronous cleanup was safe, but readers established before the purge remained active. The upstream fix relocates batadv_mcast_purge_orig() into batadv_orig_node_release(), placing it immediately before the call_rcu() invocation. This guarantees that all readers active at purge time have drained before the orig_node memory is freed.

Attack Vector

Exploitation requires the attacker to be on the same Layer 2 network segment as a vulnerable host running batman-adv. By generating crafted multicast traffic or repeatedly joining and leaving the mesh, an attacker can race the purge routine against concurrent multicast lookups. Successful exploitation triggers memory corruption in kernel space, which may result in a kernel oops, denial of service, or, under favorable heap conditions, arbitrary kernel code execution. No authentication is required.

No public proof-of-concept code is available. Refer to the upstream commits listed in the references for the exact patched code paths, including commit 20c2d6a2 and commit ff3a4487.

Detection Methods for CVE-2026-64096

Indicators of Compromise

Kernel oops or panic messages referencing batadv_mcast_purge_orig, batadv_orig_node_release, or mcast_want_all_ipv6_node in dmesg or /var/log/kern.log.
KASAN (Kernel Address Sanitizer) reports flagging use-after-free reads in the batman-adv module.
Unexpected node reboots on mesh routers or IoT gateways using batman-adv.

Detection Strategies

Inventory Linux hosts loading the batman_adv module using lsmod | grep batman_adv across managed endpoints.
Correlate kernel crash telemetry with batman-adv stack frames to surface exploitation attempts.
Monitor for abnormal multicast join/leave rates on mesh interfaces that may indicate race-condition probing.

Monitoring Recommendations

Forward kernel logs and crash dumps to a centralized data lake for retention and correlation.
Track kernel version and loaded module inventory continuously to identify unpatched hosts.
Alert on repeated batman_adv module reloads or interface flaps, which can accompany exploitation attempts.

How to Mitigate CVE-2026-64096

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the NVD advisory to all affected stable branches.
Reboot patched systems to load the fixed kernel image, since batman-adv is typically in-tree.
If patching is delayed, restrict Layer 2 access to mesh interfaces by segmenting untrusted devices.

Patch Information

The fix moves batadv_mcast_purge_orig() into batadv_orig_node_release() immediately before call_rcu(), ensuring RCU readers have drained before memory reclamation. Patches are available in multiple upstream commits, including 20c2d6a2, 70bcb678, 78a63fb2, 8a370765, aef897c9, ced48f55, edfb1e09, and ff3a4487. Consult your distribution's security tracker for backported package versions.

Workarounds

Unload the batman_adv module on hosts that do not require mesh networking using modprobe -r batman_adv.
Blacklist the module in /etc/modprobe.d/ to prevent automatic loading at boot.
Disable multicast forwarding on mesh interfaces where operationally feasible until patches are deployed.

bash

# Verify batman_adv module status and blacklist if unused
lsmod | grep batman_adv
sudo modprobe -r batman_adv
echo "blacklist batman_adv" | sudo tee /etc/modprobe.d/blacklist-batman-adv.conf
sudo update-initramfs -u