PT-2026-64333 · Linux · Linux
CVE-2026-64218
·
Published
2026-07-24
·
Updated
2026-07-24
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
In the Linux kernel, the following vulnerability has been resolved:
batman-adv: bla: fix report work leak on backbone gw purge
batadv bla purge backbone gw() removes stale backbone gateway entries,
but fails to properly handle their associated report work:
- If report work is running, the purge must wait for it to finish before freeing the backbone gw, otherwise the worker may access freed memory (e.g. bat priv).
- If report work is pending, the purge must cancel it and release the reference held for that pending work item.
The previous implementation called hlist for each entry safe() inside a
spin lock bh() section, but cancel work sync() may sleep and therefore
cannot be called from within a spinlock-protected region.
Restructure the loop to handle one entry per spinlock critical section:
acquire the lock, find the next entry to purge, remove it from the hash
list, then release the lock before calling cancel work sync() and
dropping the hash entry reference. Repeat until no more entries require
purging.
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linux