PT-2026-61151 · Linux · Linux Kernel

CVE-2026-63835 · Published 2026-07-19 · Updated 2026-07-19

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A memory leak occurs in the batman-adv module when an interface is disabled. While the worker is disabled and the aggr list is freed during the batadv hardif disable interface() process, the batadv v ogm send meshif() function can still queue new socket buffers (skbs) via batadv v ogm queue on if() to the aggr list. These queued skbs are not consumed by batadv v ogm aggr work and are never freed, leading to a leak. The batadv v ogm iface disable() function must block batadv v ogm queue on if() to prevent this issue.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2026-63835

Affected Products

Linux Kernel

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2026-63835 · Security Note
• https://git.kernel.org/stable/c/d3569327fc7395b2b0461a0a0cb77a0bb74786c0 · Note
• https://git.kernel.org/stable/c/97644fdaaf6446ffbe182c5eb804fceb5b1a51b7 · Note
• https://twitter.com/VulmonFeeds/status/2078838245832430028 · Twitter Post
• https://git.kernel.org/stable/c/3d4548c96d6f21ac1a9b06c5f82f3ef439c87023 · Note
• https://git.kernel.org/stable/c/86ab6b6fb5b82163bf6c45780bb72150021d7349 · Note
• https://git.kernel.org/stable/c/d11c00b95b2a3b3934007fc003dccc6fdcc061ad · Note
• https://git.kernel.org/stable/c/d462ced79dd430200cf888984e8005da77fc810b · Note
• https://git.kernel.org/stable/c/f04dde74399431fb07abbdd9cd5d0ed624771d04 · Note
• https://git.kernel.org/stable/c/f79deaaf822ab0ee2424cf28781f9ab91576bea3 · Note