CVE-2026-64096 Linux CVE debrief

Who should care

Linux kernel maintainers and users, network administrators, and security teams should be aware of this vulnerability and take necessary actions to mitigate it. They should review and update Linux kernel configurations to ensure the batman-adv module is properly secured and monitor system logs for potential exploitation attempts.

Technical summary

The batman-adv module in the Linux kernel has a use-after-free vulnerability. The batadv_mcast_purge_orig() function removes entries from RCU-protected hlists but does not wait for an RCU grace period before returning. This allows concurrent RCU readers to access already freed memory, potentially causing system crashes or code execution. The vulnerability was resolved by moving batadv_mcast_purge_orig() to batadv_orig_node_release(), ensuring RCU readers have drained before orig_node memory is reclaimed.

Defensive priority

High

Recommended defensive actions

• Apply the official patch from the Linux kernel repository
• Review and update Linux kernel configurations to ensure batman-adv module is properly secured
• Monitor system logs for potential exploitation attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability was resolved by moving batadv_mcast_purge_orig() to batadv_orig_node_release(), ensuring RCU readers have drained before orig_node memory is reclaimed. This change prevents use-after-free issues by synchronizing the removal of entries from RCU-protected hlists with the actual memory reclamation. Linux kernel maintainers and users should verify their kernel configurations and update to the latest version if necessary. The official patch from the Linux kernel repository should be applied, and system logs should be monitored for potential exploitation attempts.

Official resources