PT-2026-61410 · Linux · Linux
CVE-2026-64093
·
Publicado
2026-07-19
·
Atualizado
2026-07-19
CVSS v3.1
8.8
Alta
| Vetor | AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
In the Linux kernel, the following vulnerability has been resolved:
batman-adv: tp meter: directly shut down timer on cleanup
batadv tp sender cleanup() was calling timer delete sync() followed by
timer delete() to guard against the timer handler re-arming itself between
the two calls. This double-deletion hack relied on the sending status being
set to 0 to suppress re-arming.
Replace both calls with a single timer shutdown sync(). This function both
waits for any running timer callback to complete (like timer delete sync())
and permanently disarms the timer so it cannot be re-armed afterwards,
making re-arming prevention unconditional and self-documenting.
The re-arming property is also required because otherwise:
- context 0 (batadv tp recv ack()) checks in batadv tp reset sender timer() if sending is still 1 -> it is
- context 1 changes in batadv tp sender shutdown() sending to 0 and in this process forces the kthread to stop timer in batadv tp sender cleanup()
- context 0 continues in batadv tp reset sender timer() and rearms the timer -> but the reference for it is already gone
Correção
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Linux