CVE-2026-64218: Linux Kernel Use-After-Free Vulnerability

CVE-2026-64218 Overview

CVE-2026-64218 is a Linux kernel vulnerability in the batman-adv (B.A.T.M.A.N. Advanced) mesh networking module. The flaw resides in batadv_bla_purge_backbone_gw(), the function responsible for removing stale backbone gateway entries in the Bridge Loop Avoidance (BLA) subsystem. The function fails to properly synchronize with the associated report_work workqueue item before freeing memory. A local attacker with low privileges on a system running batman-adv can trigger use-after-free conditions on kernel memory, including bat_priv structures.

Critical Impact
A local, low-privileged actor can trigger use-after-free access to freed kernel memory in the batman-adv module, potentially resulting in kernel memory corruption and loss of confidentiality, integrity, and availability.

Affected Products

Linux kernel versions containing the batman-adv module prior to the fix commits referenced below
Distributions shipping vulnerable stable kernel branches (see kernel.org stable trees)
Systems using B.A.T.M.A.N. Advanced mesh networking with Bridge Loop Avoidance enabled

Discovery Timeline

2026-07-24 - CVE-2026-64218 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-64218

Vulnerability Analysis

The vulnerability is a use-after-free condition combined with a workqueue lifecycle management error in the Linux kernel's batman-adv bridge loop avoidance code. batadv_bla_purge_backbone_gw() iterates over backbone gateway entries to remove stale records. Each backbone gateway holds an associated report_work deferred work item that references shared state such as bat_priv.

The purge path did not wait for report_work to finish or cancel pending instances before releasing references. If report_work was running while the entry was freed, the worker could access memory that had already been released. If report_work was pending, the reference it held was never dropped, resulting in a resource leak.

Root Cause

The original loop used hlist_for_each_entry_safe() under a spin_lock_bh() critical section. Correctly synchronizing with the worker requires calling cancel_work_sync(), which may sleep. Sleeping functions cannot be invoked from within a spinlock-protected region, so the code could neither safely cancel nor wait on the pending or running work item. This mismatch between locking context and required synchronization primitives produced the leak and use-after-free window.

Attack Vector

Exploitation requires local access with low privileges on a host running the vulnerable batman-adv module with BLA active. An attacker able to influence backbone gateway lifecycle events, such as through crafted mesh traffic or repeated interface state changes, can race the purge routine against report_work execution. Successful exploitation yields kernel memory access after free, which can be leveraged for privilege escalation or kernel denial of service. The upstream fix restructures the loop to process one entry per critical section: acquire the lock, unlink one entry, release the lock, then call cancel_work_sync() and drop the hash_entry reference outside the spinlock. See the fix commits 0459430, 3423a45, 4866315, 95a7034, c6de1a5, ce2c0ee, eeddd7b, and f1303ad for backport details.

Detection Methods for CVE-2026-64218

Indicators of Compromise

Kernel oops or panic messages referencing batadv_bla_purge_backbone_gw, batadv_bla_send_claim, or report_work in dmesg output
KASAN reports flagging use-after-free reads within the batman-adv module targeting bat_priv or backbone_gw structures
Unexpected batman-adv module crashes on systems running mesh networking with Bridge Loop Avoidance enabled

Detection Strategies

Inventory Linux hosts loading the batman_adv kernel module using lsmod | grep batman_adv and correlate against patched kernel versions
Enable KASAN and workqueue debugging (CONFIG_DEBUG_WORKQUEUE) in test environments to surface the race deterministically
Monitor kernel logs for stack traces containing batman-adv symbols following mesh topology changes

Monitoring Recommendations

Forward /var/log/kern.log and journalctl -k output to a centralized log platform and alert on batman-adv fault signatures
Track kernel version drift across mesh nodes to ensure all endpoints receive the stable-tree backport
Watch for anomalous local process activity coinciding with batman-adv interface changes on multi-tenant hosts

How to Mitigate CVE-2026-64218

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the fix commits and reboot affected systems
If patching is not immediately possible, unload the batman_adv module on hosts where mesh networking is not required using modprobe -r batman_adv
Restrict local access to systems running batman-adv and audit users with permissions to manipulate network interfaces

Patch Information

The fix restructures batadv_bla_purge_backbone_gw() to remove one entry per spinlock critical section, then calls cancel_work_sync() and releases the hash_entry reference outside the lock. The change is available in the following stable-tree commits: Linux Kernel Commit 0459430, Linux Kernel Commit 3423a45, Linux Kernel Commit 4866315, Linux Kernel Commit 95a7034, Linux Kernel Commit c6de1a5, Linux Kernel Commit ce2c0ee, Linux Kernel Commit eeddd7b, and Linux Kernel Commit f1303ad. Consult your distribution's security tracker for backport availability.

Workarounds

Blacklist the batman_adv module on systems that do not require mesh networking by adding blacklist batman_adv to /etc/modprobe.d/blacklist.conf
Disable Bridge Loop Avoidance on batman-adv interfaces where operationally acceptable using batctl bl 0
Limit unprivileged user access to network configuration utilities through Linux capabilities and mandatory access control policies

bash

# Configuration example: blacklist the vulnerable module until patched
echo 'blacklist batman_adv' | sudo tee /etc/modprobe.d/disable-batman-adv.conf
sudo modprobe -r batman_adv

# Verify the module is not loaded
lsmod | grep batman_adv