CVE-2026-64091

What it actually does

This is a race condition in the Linux kernel batman-adv mesh networking subsystem. While generating local translation table VLAN information for a TVLV buffer, the kernel first calculates the required buffer size and later fills that buffer while related VLAN/translation-table state can still change. A VLAN that was empty during the size calculation can become non-empty before the buffer is populated, causing the code to write more VLAN entries than were allocated. In practical terms, this can lead to kernel memory corruption, denial of service through a kernel crash, and potentially privilege escalation or arbitrary code execution in kernel context depending on exploitability and kernel hardening.

Why it matters to the business

Systems using the batman-adv kernel module for mesh networking could be crashed or potentially compromised by network-level interaction with the mesh subsystem. The main operational risk is loss of availability for routers, gateways, embedded Linux devices, wireless mesh nodes, or appliances that rely on batman-adv. Because the issue is in kernel networking code and carries a critical CVSS score, affected exposed mesh infrastructure should be prioritized even though public exploit maturity is currently reported as none, EPSS is low, and it is not listed in CISA KEV or known ransomware use.

How an attack unfolds

An attacker first needs a path to interact with a system using the batman-adv mesh networking subsystem. They then induce rapid translation-table and VLAN state changes so that, during TVLV generation, the kernel calculates a buffer size based on one view of the VLAN list but later fills it using a changed view where additional VLANs now require entries. If the timing succeeds, the kernel writes past the allocated buffer. The most reliable outcome is likely a kernel crash or networking disruption; a more advanced attacker could attempt to shape heap layout and use the memory corruption for kernel-level code execution or privilege escalation. Exploitation is timing-sensitive but the CVSS vector indicates it may be reachable over the network without authentication or user interaction when vulnerable batman-adv functionality is exposed.

How to fix it

Apply a Linux kernel update from the operating system or appliance vendor that includes the upstream batman-adv fix for the reported VLAN TOCTOU race. No exact affected product list or fixed package versions were provided, so organizations should rely on vendor advisories and kernel changelogs referencing the batman-adv TT VLAN race fix. Where immediate patching is not possible, reduce exposure by disabling the batman-adv module if unused, unloading or blacklisting the module, disabling affected mesh interfaces, restricting access to batman-adv mesh networks to trusted nodes only, and monitoring for abnormal mesh/VLAN churn or kernel instability. Mitigations should be treated as temporary because the flaw is in kernel memory handling.

How to confirm the fix worked

Confirm remediation by verifying that the running kernel package is at or above the vendor-fixed version and that the vendor advisory or changelog includes the batman-adv translation-table VLAN race fix. Check the active kernel with `uname -a` and package-manager metadata, then confirm whether the `batman_adv` module is loaded with `lsmod | grep batman_adv`. If batman-adv is not required, validate that it is unloaded and cannot be autoloaded, for example through module blacklist policy and reboot testing. For systems where batman-adv remains enabled, review kernel logs after patching or mitigation for absence of recurring batman-adv warnings, KASAN reports, slab corruption messages, general protection faults, kernel panics, or unexplained reboots under normal mesh traffic.

Typical attack path

1. Identify a Linux system participating in or reachable through a batman-adv mesh network.
2. Confirm that the batman-adv kernel module is loaded and that mesh/VLAN/translation-table functionality is active or reachable.
3. Generate crafted or high-rate mesh networking activity that causes translation-table entries and VLAN state to change rapidly.
4. Trigger local TT-based TVLV generation while VLAN state changes between the size-calculation phase and the buffer-population phase.
5. Cause an out-of-bounds kernel memory write due to an undersized buffer.
6. Use the resulting memory corruption to crash the host, disrupt mesh routing, or attempt further kernel exploitation.

How to detect it

Look for evidence of attempted or successful exploitation in kernel and system logs rather than application logs. Useful sources include `dmesg`, journald kernel entries, `/var/log/kern.log`, `/var/log/messages`, `/var/log/syslog`, crash dump directories, watchdog reset logs, and centralized telemetry from network appliances. Focus on systems where the `batman_adv` module is loaded or where interfaces such as `bat0` are present. Indicators include kernel panics, general protection faults, KASAN or slab out-of-bounds reports, use-after-free or memory-corruption messages, call traces involving batman-adv translation-table or TVLV functions, sudden reboots, and abnormal mesh/VLAN churn immediately before instability. Network telemetry may show bursts of batman-adv mesh traffic or repeated topology/translation-table changes, but packet-level indicators are not expected to be stable across attacks. Because no public exploit is reported, detection should emphasize anomalous kernel crashes and forensic correlation with batman-adv activity.

• batman_adv
• batman-adv
• bat0
• BUG: KASAN
• slab-out-of-bounds
• out-of-bounds
• kernel BUG
• general protection fault
• Kernel panic
• Oops:
• Call Trace:
• batadv_tt
• batadv_tvlv
• batadv_vlan
• translation table
• /var/log/kern.log
• /var/log/messages
• /var/log/syslog
• /sys/module/batman_adv
• /proc/modules

What your security team should do

• Inventory Linux systems, embedded devices, routers, wireless mesh nodes, and appliances that load or ship the `batman_adv` kernel module.
• Prioritize patching internet-adjacent, untrusted-network-adjacent, or operationally critical mesh networking systems even though EPSS is currently low and the issue is not in KEV.
• Apply vendor kernel updates that include the upstream batman-adv TT VLAN race fix; where fixed versions are not yet published, track vendor advisories closely.
• Disable, unload, or blacklist `batman_adv` on systems that do not explicitly require batman-adv mesh networking.
• Restrict batman-adv mesh participation to trusted nodes and limit untrusted network access to mesh interfaces until patching is complete.
• Enable or collect kernel logs centrally from affected systems, including `dmesg`, journald, syslog, crash dumps, and watchdog reboot records.
• Investigate recent kernel panics, KASAN/slab out-of-bounds reports, unexplained reboots, or mesh routing instability on systems using batman-adv.
• For high-assurance environments, perform post-patch stress testing of batman-adv VLAN and translation-table behavior in staging before broad rollout.