CVE-2026-64096
batman-adv: mcast: fix use-after-free in orig_node RCU release
Description
In the Linux kernel, the following vulnerability has been resolved: batman-adv: mcast: fix use-after-free in orig_node RCU release batadv_mcast_purge_orig() removes entries from RCU-protected hlists but does not wait for an RCU grace period before returning. Concurrent RCU readers may still accesses references to those entries at the point of removal. RCU-protected readers trying to operate on entries like orig->mcast_want_all_ipv6_node will then access already freed memory. Fix this by moving batadv_mcast_purge_orig() to batadv_orig_node_release(), just before the call_rcu() invocation. This ensures RCU readers that were active at purge time have drained before the orig_node memory is reclaimed.
INFO
Published Date :
July 19, 2026, 4:17 p.m.
Last Modified :
July 19, 2026, 4:17 p.m.
Remotely Exploit :
No
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Affected Products
The following products are affected by CVE-2026-64096
vulnerability.
Even if cvefeed.io is aware of the exact versions of the
products
that
are
affected, the information is not represented in the table below.
No affected product recoded yet
Solution
- Apply the kernel patch to the batman-adv module.
- Ensure RCU grace periods are respected before memory reclamation.
- Update the Linux kernel to a patched version.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-64096.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-64096 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-64096
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-64096 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-64096 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jul. 19, 2026
Action Type Old Value New Value Added Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': 'ab49886e3da73b6b35ece21006e191910427bb30', 'lessThan': 'ff3a4487ead475e27b43280b8ee3d8464fe280e1', 'versionType': 'git'}, {'status': 'affected', 'version': 'ab49886e3da73b6b35ece21006e191910427bb30', 'lessThan': '78a63fb2f7d5630d1c1f2859a20d4e4226863b41', 'versionType': 'git'}, {'status': 'affected', 'version': 'ab49886e3da73b6b35ece21006e191910427bb30', 'lessThan': 'ced48f55bac73f0822eae90509e51b42b4f646c8', 'versionType': 'git'}, {'status': 'affected', 'version': 'ab49886e3da73b6b35ece21006e191910427bb30', 'lessThan': '70bcb678561f0fb58f33270fc73f12f3be72b878', 'versionType': 'git'}, {'status': 'affected', 'version': 'ab49886e3da73b6b35ece21006e191910427bb30', 'lessThan': 'aef897c9d2dd0d9339167fb82b62beff68d076cb', 'versionType': 'git'}, {'status': 'affected', 'version': 'ab49886e3da73b6b35ece21006e191910427bb30', 'lessThan': '8a3707653ab658e082ccd992e92594e01b09a3fc', 'versionType': 'git'}, {'status': 'affected', 'version': 'ab49886e3da73b6b35ece21006e191910427bb30', 'lessThan': 'edfb1e094104a50f931553dc82ac59246569fd32', 'versionType': 'git'}, {'status': 'affected', 'version': 'ab49886e3da73b6b35ece21006e191910427bb30', 'lessThan': '20c2d6a20ca936f5aaa6dd40f73f262ac45c87cc', 'versionType': 'git'}], 'programFiles': ['net/batman-adv/originator.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '3.15'}, {'status': 'unaffected', 'version': '0', 'lessThan': '3.15', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '5.10.258', 'versionType': 'semver', 'lessThanOrEqual': '5.10.*'}, {'status': 'unaffected', 'version': '5.15.209', 'versionType': 'semver', 'lessThanOrEqual': '5.15.*'}, {'status': 'unaffected', 'version': '6.1.175', 'versionType': 'semver', 'lessThanOrEqual': '6.1.*'}, {'status': 'unaffected', 'version': '6.6.142', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.92', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.34', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.0.11', 'versionType': 'semver', 'lessThanOrEqual': '7.0.*'}, {'status': 'unaffected', 'version': '7.1', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['net/batman-adv/originator.c'], 'defaultStatus': 'affected'}] Added Description In the Linux kernel, the following vulnerability has been resolved: batman-adv: mcast: fix use-after-free in orig_node RCU release batadv_mcast_purge_orig() removes entries from RCU-protected hlists but does not wait for an RCU grace period before returning. Concurrent RCU readers may still accesses references to those entries at the point of removal. RCU-protected readers trying to operate on entries like orig->mcast_want_all_ipv6_node will then access already freed memory. Fix this by moving batadv_mcast_purge_orig() to batadv_orig_node_release(), just before the call_rcu() invocation. This ensures RCU readers that were active at purge time have drained before the orig_node memory is reclaimed. Added Reference https://git.kernel.org/stable/c/20c2d6a20ca936f5aaa6dd40f73f262ac45c87cc Added Reference https://git.kernel.org/stable/c/70bcb678561f0fb58f33270fc73f12f3be72b878 Added Reference https://git.kernel.org/stable/c/78a63fb2f7d5630d1c1f2859a20d4e4226863b41 Added Reference https://git.kernel.org/stable/c/8a3707653ab658e082ccd992e92594e01b09a3fc Added Reference https://git.kernel.org/stable/c/aef897c9d2dd0d9339167fb82b62beff68d076cb Added Reference https://git.kernel.org/stable/c/ced48f55bac73f0822eae90509e51b42b4f646c8 Added Reference https://git.kernel.org/stable/c/edfb1e094104a50f931553dc82ac59246569fd32 Added Reference https://git.kernel.org/stable/c/ff3a4487ead475e27b43280b8ee3d8464fe280e1