CVE-2026-64093 Linux CVE debrief

Who should care

Linux kernel maintainers, Linux distribution vendors, and users of Linux systems with batman-adv enabled should be aware of this update to ensure their systems are protected. They should review and apply the kernel update to ensure the batman-adv module is using the corrected tp_meter functionality. System administrators should verify that Linux systems with batman-adv enabled are updated with the latest kernel patches and monitor system logs for any unusual activity related to the batman-adv module.

Technical summary

In the Linux kernel, the batman-adv module's tp_meter component had a vulnerability that has been resolved. The original code used a double-deletion hack, calling timer_delete_sync() followed by timer_delete(), to prevent the timer handler from re-arming itself between the two calls. This was replaced with a single call to timer_shutdown_sync(), which both waits for any running timer callback to complete and permanently disarms the timer, making re-arming prevention unconditional and self-documenting.

Defensive priority

Medium

Recommended defensive actions

• Review and apply the kernel update to ensure the batman-adv module is using the corrected tp_meter functionality.
• Verify that Linux systems with batman-adv enabled are updated with the latest kernel patches.
• Monitor system logs for any unusual activity related to the batman-adv module.
• Perform a thorough review of system configurations and ensure that all necessary security measures are in place.
• Consider implementing additional monitoring and detection tools to identify potential security threats.
• Conduct regular security audits to ensure the integrity of the system.
• Keep track of any changes to the Linux kernel and batman-adv module to ensure timely updates and patches.

Evidence notes

The CVE record was published on 2026-07-19T16:17:50.230Z and has not been modified since then. The NVD entry is currently Received. The Linux kernel was updated to address a vulnerability in the batman-adv module. The issue involved the tp_meter component, where a double-deletion hack was used to prevent timer re-arming. This was replaced with a single call to timer_shutdown_sync(), which waits for any running timer callback to complete and permanently disarms the timer. The vulnerability has been resolved, but users should verify their systems are protected.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.