CVE-2026-64092 Linux CVE debrief

Who should care

Linux kernel maintainers, Linux distribution vendors, users of batman-adv tp_meter functionality, and security teams responsible for vulnerability management should be aware of this issue. They should review the provided patches and ensure their systems are updated to prevent potential exploitation. Additionally, operators and platform administrators may need to assess the impact on their systems and implement necessary mitigations.

Technical summary

The Linux kernel's batman-adv tp_meter component has a vulnerability that can cause a tp_vars reference leak during receiver shutdown. This issue arises from flawed logic coordinating the release of tp_vars references between batadv_tp_receiver_shutdown() and batadv_tp_stop_all(). Specifically, if the receiver shutdown timer had already expired when batadv_tp_stop_all() attempted to rearm itself, batadv_tp_stop_all() would skip calling batadv_tp_vars_put(), and batadv_tp_receiver_shutdown() would also fail to release its tp_vars reference. This results in a reference leak. The fix introduces a new atomic variable 'receiving' to track the receiver's initialization status. The side observing the transition of 'receiving' from 1 to 0 is responsible for releasing the tp_vars reference, eliminating uncertainty.

Defensive priority

Medium

Recommended defensive actions

• Review and apply the provided kernel patches to address the vulnerability.
• Ensure all Linux kernel packages are up-to-date with the latest security patches.
• Monitor system logs for any suspicious batman-adv tp_meter activity.
• Consider implementing additional monitoring and logging for kernel components.
• Perform a thorough review of system configurations and assess potential exposure.
• Inventory affected systems and prioritize patching based on risk and exposure.
• Verify patch deployment and system hardening through regular security audits.

Evidence notes

The CVE record was published on 2026-07-19T16:17:50.110Z and has not been modified since then. The NVD entry is currently Received. Multiple source references are provided, including several kernel.org links. However, the source detail is limited, and further verification is needed to confirm the affected scope and severity. Defenders should review the official advisory and CVE record to validate affected scope, severity, and vendor guidance.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.