PT-2026-61412 · Linux · Linux
CVE-2026-64095
·
Published
2026-07-19
·
Updated
2026-07-19
CVSS v3.1
7.1
High
| Vector | AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H |
In the Linux kernel, the following vulnerability has been resolved:
batman-adv: bla: avoid double decrement of bla.num requests
The bla.num requests is increased when no request sent was in progress. And
it is decremented in various places (announcement was received, backbone is
purged, periodic work). But the check if the request sent is actually set
to a specific state and the atomic dec/ inc are not safe because they are
not atomic (TOCTOU) and multiple such code portions can run concurrently.
At the same time, it is necessary to modify request sent (state) and
bla.num requests atomically. Otherwise batadv bla send request() might set
request sent to 1 and is interrupted. batadv handle announce() can then
set request sent back to 0 and decrement num requests before
batadv bla send request() incremented it.
The two operations must therefore be locked. And since state (request sent)
and wait periods are only accessed inside this lock, they can be converted
to simpler datatypes. And to avoid that the bla.num requests is touched by
a parallel running context with a valid backbone gw reference after
batadv bla purge backbone gw() ran, a third state "stopped" is required to
correctly signal that a backbone gw is in the state of being cleaned up.
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linux