PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-64092 Linux CVE debrief

A vulnerability in Linux kernel's batman-adv tp_meter component has been identified, which may lead to a tp_vars reference leak in receiver shutdown. This issue arises from flawed logic coordinating the release of tp_vars references between batadv_tp_receiver_shutdown() and batadv_tp_stop_all(). Specifically, if the receiver shutdown timer had already expired when batadv_tp_stop_all() attempted to rearm itself, batadv_tp_stop_all() would skip calling batadv_tp_vars_put(), and batadv_tp_receiver_shutdown() would also fail to release its tp_vars reference. This results in a reference leak. The fix introduces a new atomic variable 'receiving' to track the receiver's initialization status. The side observing the transition of 'receiving' from 1 to 0 is responsible for releasing the tp_vars reference, eliminating uncertainty. The Linux kernel maintainers and distribution vendors should review the provided patches and ensure their systems are updated to prevent potential exploitation.

Vendor
Linux
Product
Unknown
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-19
Original CVE updated
2026-07-19
Advisory published
2026-07-19
Advisory updated
2026-07-19

Who should care

Linux kernel maintainers, Linux distribution vendors, users of batman-adv tp_meter functionality, and security teams responsible for vulnerability management should be aware of this issue. They should review the provided patches and ensure their systems are updated to prevent potential exploitation. Additionally, operators and platform administrators may need to assess the impact on their systems and implement necessary mitigations.

Technical summary

The Linux kernel's batman-adv tp_meter component has a vulnerability that can cause a tp_vars reference leak during receiver shutdown. This issue arises from flawed logic coordinating the release of tp_vars references between batadv_tp_receiver_shutdown() and batadv_tp_stop_all(). Specifically, if the receiver shutdown timer had already expired when batadv_tp_stop_all() attempted to rearm itself, batadv_tp_stop_all() would skip calling batadv_tp_vars_put(), and batadv_tp_receiver_shutdown() would also fail to release its tp_vars reference. This results in a reference leak. The fix introduces a new atomic variable 'receiving' to track the receiver's initialization status. The side observing the transition of 'receiving' from 1 to 0 is responsible for releasing the tp_vars reference, eliminating uncertainty.

Defensive priority

Medium

Recommended defensive actions

  • Review and apply the provided kernel patches to address the vulnerability.
  • Ensure all Linux kernel packages are up-to-date with the latest security patches.
  • Monitor system logs for any suspicious batman-adv tp_meter activity.
  • Consider implementing additional monitoring and logging for kernel components.
  • Perform a thorough review of system configurations and assess potential exposure.
  • Inventory affected systems and prioritize patching based on risk and exposure.
  • Verify patch deployment and system hardening through regular security audits.

Evidence notes

The CVE record was published on 2026-07-19T16:17:50.110Z and has not been modified since then. The NVD entry is currently Received. Multiple source references are provided, including several kernel.org links. However, the source detail is limited, and further verification is needed to confirm the affected scope and severity. Defenders should review the official advisory and CVE record to validate affected scope, severity, and vendor guidance.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-19T16:17:50.110Z and has not been modified since then.