PT-2026-61413 · Linux · Linux

CVE-2026-64096 · Publicado 2026-07-19 · Atualizado 2026-07-19

NVD

CVSS v3.1

8.8

Alta

Vetor base

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

In the Linux kernel, the following vulnerability has been resolved:

batman-adv: mcast: fix use-after-free in orig node RCU release

batadv mcast purge orig() removes entries from RCU-protected hlists but does not wait for an RCU grace period before returning. Concurrent RCU readers may still accesses references to those entries at the point of removal. RCU-protected readers trying to operate on entries like orig->mcast want all ipv6 node will then access already freed memory.

Fix this by moving batadv mcast purge orig() to batadv orig node release(), just before the call rcu() invocation. This ensures RCU readers that were active at purge time have drained before the orig node memory is reclaimed.

Correção

Identificadores relacionados

CVE-2026-64096

Produtos afetados

Linux

Referências · 9

• https://git.kernel.org/stable/c/ced48f55bac73f0822eae90509e51b42b4f646c8 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-64096 · Nota de Segurança
• https://git.kernel.org/stable/c/edfb1e094104a50f931553dc82ac59246569fd32 · Nota
• https://git.kernel.org/stable/c/ff3a4487ead475e27b43280b8ee3d8464fe280e1 · Nota
• https://git.kernel.org/stable/c/70bcb678561f0fb58f33270fc73f12f3be72b878 · Nota
• https://git.kernel.org/stable/c/78a63fb2f7d5630d1c1f2859a20d4e4226863b41 · Nota
• https://git.kernel.org/stable/c/8a3707653ab658e082ccd992e92594e01b09a3fc · Nota
• https://git.kernel.org/stable/c/20c2d6a20ca936f5aaa6dd40f73f262ac45c87cc · Nota
• https://git.kernel.org/stable/c/aef897c9d2dd0d9339167fb82b62beff68d076cb · Nota