CVE-2026-64093 Linux CVE debrief

Who should care

Linux kernel maintainers, Linux distribution vendors, and users of Linux systems with batman-adv enabled should be aware of this update to ensure their systems are protected. They should review and apply the kernel update to ensure the batman-adv module is using the corrected tp_meter functionality. System administrators should verify that Linux systems with batman-adv enabled are updated with the latest kernel patches and monitor system logs for any unusual activity related to the batman-adv module.

Technical summary

In the Linux kernel, the batman-adv module's tp_meter component had a vulnerability that has been resolved. The original code used a double-deletion hack, calling timer_delete_sync() followed by timer_delete(), to prevent the timer handler from re-arming itself between the two calls. This was replaced with a single call to timer_shutdown_sync(), which both waits for any running timer callback to complete and permanently disarms the timer, making re-arming prevention unconditional and self-documenting.

Defensive priority

Medium

Recommended defensive actions

• Review and apply the kernel update to ensure the batman-adv module is using the corrected tp_meter functionality.
• Verify that Linux systems with batman-adv enabled are updated with the latest kernel patches.
• Monitor system logs for any unusual activity related to the batman-adv module.
• Perform a thorough review of system configurations and ensure that all necessary security measures are in place.
• Consider implementing additional monitoring and detection tools to identify potential security threats.
• Conduct regular security audits to ensure the integrity of the system.
• Keep track of any changes to the Linux kernel and batman-adv module to ensure timely updates and patches.

Evidence notes

The CVE record was published on 2026-07-19T16:17:50.230Z and has not been modified since then. The NVD entry is currently Received. The Linux kernel was updated to address a vulnerability in the batman-adv module. The issue involved the tp_meter component, where a double-deletion hack was used to prevent timer re-arming. This was replaced with a single call to timer_shutdown_sync(), which waits for any running timer callback to complete and permanently disarms the timer. The vulnerability has been resolved, but users should verify their systems are protected.

Official resources