CVE-2026-64095 - Vulnerability Details

- batman-adv: bla: avoid double decrement of bla.num_requests

Description

In the Linux kernel, the following vulnerability has been resolved:

batman-adv: bla: avoid double decrement of bla.num_requests

The bla.num_requests is increased when no request_sent was in progress. And
it is decremented in various places (announcement was received, backbone is
purged, periodic work). But the check if the request_sent is actually set
to a specific state and the atomic_dec/_inc are not safe because they are
not atomic (TOCTOU) and multiple such code portions can run concurrently.

At the same time, it is necessary to modify request_sent (state) and
bla.num_requests atomically. Otherwise batadv_bla_send_request() might set
request_sent to 1 and is interrupted. batadv_handle_announce() can then
set request_sent back to 0 and decrement num_requests before
batadv_bla_send_request() incremented it.

The two operations must therefore be locked. And since state (request_sent)
and wait_periods are only accessed inside this lock, they can be converted
to simpler datatypes. And to avoid that the bla.num_requests is touched by
a parallel running context with a valid backbone_gw reference after
batadv_bla_purge_backbone_gw() ran, a third state "stopped" is required to
correctly signal that a backbone_gw is in the state of being cleaned up.

Published: 2026-07-19

Score: 7.1 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerability is a race condition in the batman-adv subsystem of the Linux kernel where concurrent decrements of the bla.num_requests counter can occur without proper atomic synchronization. This flaw causes the counter and the request_sent state to become inconsistent, potentially leading to negative or corrupted values, kernel crashes, or disabling batman-adv functionality. The weakness is a Time‑of‑Check to Time‑of‑Use race (CWE‑367).

Affected Systems

All Linux kernel deployments that include the batman-adv module are affected, as the flaw originates in the kernel’s batman‑adv code. No specific kernel version is listed, so all kernel releases prior to the fix are considered impacted.

Risk and Exploitability

The CVSS score of 7.1 signals moderate severity, and the EPSS score of less than 1% indicates a low likelihood of exploitation. The vulnerability is not cataloged in CISA’s KEV list. Based on the description, it is inferred that an attacker would need to have local or privileged access to trigger the concurrent contexts that expose the race condition. If successfully exploited, the inconsistency could lead to system instability or denial of service.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`23721387c409087fd3b97e274f34d3ddc0970b74`	affected	< 1f013bc94154f2e78e97d0296175664224c796e0
`23721387c409087fd3b97e274f34d3ddc0970b74`	affected	< 5328b95960774f2e189f22485616bc7b8eb2f7e3
`23721387c409087fd3b97e274f34d3ddc0970b74`	affected	< 8ff9c59d1b7b48c2596878341a5310f32895d52b
`23721387c409087fd3b97e274f34d3ddc0970b74`	affected	< a9393751ecf7e9096f93cb6eed02db4f79125765
`23721387c409087fd3b97e274f34d3ddc0970b74`	affected	< 461f1e3dfb888701895b766446c55db2b10db705
`23721387c409087fd3b97e274f34d3ddc0970b74`	affected	< 45384612f29692fbf0c770200361a7acff90125c
`23721387c409087fd3b97e274f34d3ddc0970b74`	affected	< 65497ad155a3246df177b5ef662cd6e5a32cb470
`23721387c409087fd3b97e274f34d3ddc0970b74`	affected	< 83ab69bd12b80f6ea169c8bea6977701b53a043d

Linux

affected

Version	Status	Constraints
`3.5`	affected	—
`0`	unaffected	< 3.5
`5.10.259`	unaffected	≤ 5.10.*
`5.15.210`	unaffected	≤ 5.15.*
`6.1.176`	unaffected	≤ 6.1.*
`6.6.143`	unaffected	≤ 6.6.*
`6.12.93`	unaffected	≤ 6.12.*
`6.18.34`	unaffected	≤ 6.18.*
`7.0.11`	unaffected	≤ 7.0.*
`7.1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[23721387c409087fd3b97e274f34d3ddc0970b74,1f013bc94154f2e78e97d0296175664224c796e0)`	affected	code_commit	—
`[23721387c409087fd3b97e274f34d3ddc0970b74,5328b95960774f2e189f22485616bc7b8eb2f7e3)`	affected	code_commit	—
`[23721387c409087fd3b97e274f34d3ddc0970b74,65497ad155a3246df177b5ef662cd6e5a32cb470)`	affected	code_commit	—
`[23721387c409087fd3b97e274f34d3ddc0970b74,83ab69bd12b80f6ea169c8bea6977701b53a043d)`	affected	code_commit	—
`[23721387c409087fd3b97e274f34d3ddc0970b74,461f1e3dfb888701895b766446c55db2b10db705)`	affected	code_commit	—
`[23721387c409087fd3b97e274f34d3ddc0970b74,45384612f29692fbf0c770200361a7acff90125c)`	affected	code_commit	—
`[23721387c40987fd3b97e274f34d3ddc0970b74,8ff9c59d1b7b48c2596878341a5310f32895d52b)`	affected	code_commit	—
`[23721387c40987fd3b97e274f34d3ddc0970b74,a9393751ecf7e9096f93cb6eed02db4f79125765)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`3.5`	affected	generic	—
`[0,3.5)`	unaffected	generic	—
`[5.10.259,5.11.0)`	unaffected	semver	—
`[5.15.210,5.16.0)`	unaffected	semver	—
`[6.1.176,6.2.0)`	unaffected	semver	—
`[6.6.143,6.7.0)`	unaffected	semver	—
`[6.12.93,6.13.0)`	unaffected	semver	—
`[6.18.34,6.19.0)`	unaffected	semver	—
`[7.0.11,7.1.0)`	unaffected	semver	—
`[7.1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Update the system to a kernel version that contains the batman-adv patch (for example the commit identified by 1f013bc93).
If the patch is not yet available, disable or unload the batman-adv kernel module until an updated kernel is released.
Monitor kernel logs such as /var/log/kern.log or dmesg for batadv counter anomalies or crashes and apply any subsequent advisory patches promptly.

Generated by OpenCVE AI on July 30, 2026 at 20:36 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Ubuntu USN	USN-8593-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8603-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8618-1	Linux kernel vulnerabilities

No CVSS v4.0

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00267.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/1f013bc94154f2e78e97d0296175664224c796e0
https://git.kernel.org/stable/c/45384612f29692fbf0c770200361a7acff90125c
https://git.kernel.org/stable/c/461f1e3dfb888701895b766446c55db2b10db705
https://git.kernel.org/stable/c/5328b95960774f2e189f22485616bc7b8eb2f7e3
https://git.kernel.org/stable/c/65497ad155a3246df177b5ef662cd6e5a32cb470
https://git.kernel.org/stable/c/83ab69bd12b80f6ea169c8bea6977701b53a043d
https://git.kernel.org/stable/c/8ff9c59d1b7b48c2596878341a5310f32895d52b
https://git.kernel.org/stable/c/a9393751ecf7e9096f93cb6eed02db4f79125765
https://lore.kernel.org/linux-cve-announce/2026071918-CVE-2026-64095-81a9@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-64095
https://www.cve.org/CVERecord?id=CVE-2026-64095

History

Mon, 20 Jul 2026 14:45:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 7.1, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H'}`

Mon, 20 Jul 2026 12:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-367
References		https://lore.kernel.org/linux-cve-announce/2026071918-CVE-2026-64095-81a9@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-64095 https://www.cve.org/CVERecord?id=CVE-2026-64095

Sun, 19 Jul 2026 16:15:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: batman-adv: bla: avoid double decrement of bla.num_requests The bla.num_requests is increased when no request_sent was in progress. And it is decremented in various places (announcement was received, backbone is purged, periodic work). But the check if the request_sent is actually set to a specific state and the atomic_dec/_inc are not safe because they are not atomic (TOCTOU) and multiple such code portions can run concurrently. At the same time, it is necessary to modify request_sent (state) and bla.num_requests atomically. Otherwise batadv_bla_send_request() might set request_sent to 1 and is interrupted. batadv_handle_announce() can then set request_sent back to 0 and decrement num_requests before batadv_bla_send_request() incremented it. The two operations must therefore be locked. And since state (request_sent) and wait_periods are only accessed inside this lock, they can be converted to simpler datatypes. And to avoid that the bla.num_requests is touched by a parallel running context with a valid backbone_gw reference after batadv_bla_purge_backbone_gw() ran, a third state "stopped" is required to correctly signal that a backbone_gw is in the state of being cleaned up.
Title		batman-adv: bla: avoid double decrement of bla.num_requests
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/1f013bc94154f2e78e97d0296175664224c796e0 https://git.kernel.org/stable/c/45384612f29692fbf0c770200361a7acff90125c https://git.kernel.org/stable/c/461f1e3dfb888701895b766446c55db2b10db705 https://git.kernel.org/stable/c/5328b95960774f2e189f22485616bc7b8eb2f7e3 https://git.kernel.org/stable/c/65497ad155a3246df177b5ef662cd6e5a32cb470 https://git.kernel.org/stable/c/83ab69bd12b80f6ea169c8bea6977701b53a043d https://git.kernel.org/stable/c/8ff9c59d1b7b48c2596878341a5310f32895d52b https://git.kernel.org/stable/c/a9393751ecf7e9096f93cb6eed02db4f79125765

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-07-19T15:40:02.360Z

Updated: 2026-08-05T12:39:09.386Z

Reserved: 2026-07-19T07:54:57.033Z

Link: CVE-2026-64095

Vulnrichment

No data.

NVD

No data.

Redhat

Severity :

Publid Date: 2026-07-19T00:00:00Z

Links: CVE-2026-64095 - Bugzilla

OpenCVE Enrichment

Updated: 2026-07-30T20:45:17Z

Weaknesses

CWE-367
Time-of-check Time-of-use (TOCTOU) Race Condition

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object