CVE-2026-64094

What it actually does

This is a race-condition flaw in the Linux kernel's batman-adv mesh networking subsystem, specifically in bridge loop avoidance claim handling. When a batman-adv hard interface is selected as the primary interface without the expected RTNL locking protection, it can be detached from the mesh interface before the code finishes using it. The vulnerable path may then dereference a NULL mesh interface pointer while attempting to send an ARP request, causing a kernel NULL-pointer dereference. The most likely technical impact is a kernel oops or system crash, resulting in denial of service on systems using batman-adv mesh networking.

Why it matters to the business

Systems that rely on Linux batman-adv mesh networking may become unstable or unavailable if the vulnerable race is triggered. This can disrupt wireless mesh, embedded, IoT, industrial, campus, or community-network deployments that depend on batman-adv for connectivity. The currently low EPSS score, lack of known exploited status, and no public exploit maturity indicate limited immediate exploitation pressure, but kernel-level denial-of-service flaws should still be remediated during normal patch cycles, especially on devices where mesh networking availability is operationally important.

How an attack unfolds

An attacker would need to operate in a context where batman-adv is present and active, and where interface state changes and bridge loop avoidance claim processing can be influenced or raced. The attacker attempts to cause batman-adv to process a claim using a primary hard interface while that interface is concurrently being removed or detached from the mesh interface. If the timing is successful, the kernel code continues execution after the mesh interface pointer has become NULL and attempts to send an ARP request through that invalid state. This triggers a NULL-pointer dereference in kernel space. Practical exploitation is expected to be reliability-focused denial of service rather than code execution, and successful triggering may depend on local system capabilities, network interface control, mesh topology conditions, and timing.

How to fix it

Upgrade to a Linux kernel build that includes the upstream batman-adv fix for this issue. Because no product-specific fixed versions were provided, use the fixed kernel packages from the relevant Linux distribution, appliance vendor, Android/embedded vendor, or kernel-stable branch once available. If immediate patching is not possible, reduce exposure by disabling batman-adv where it is not required, unloading or blacklisting the batman-adv module, disabling bridge loop avoidance if operationally feasible, and restricting who can create, remove, or reconfigure mesh and network interfaces. On systems where uptime is critical, also review panic-on-oops settings because a kernel oops may escalate to a full reboot depending on configuration.

How to confirm the fix worked

Confirm whether the running kernel contains the batman-adv fix by checking the vendor advisory, kernel changelog, package version, or source commit history for the NULL-pointer dereference fix in batman-adv bridge loop avoidance claim handling. Verify exposure by checking whether the batman-adv module is loaded or built into the kernel and whether batman-adv mesh interfaces are configured. Commands such as `lsmod | grep batman_adv`, `modinfo batman-adv`, `ip link show type batadv`, and distribution package queries can help determine exposure. After remediation, confirm the updated kernel is running, not merely installed, and that the system has been rebooted if required. Monitor kernel logs after patching for absence of new batman-adv NULL-pointer dereference or oops events during interface add/remove and mesh operation tests.

Typical attack path

1. Identify a Linux system running the batman-adv kernel module with bridge loop avoidance functionality in use.
2. Gain the ability to influence batman-adv mesh traffic, interface membership, or interface teardown events, depending on deployment and privileges.
3. Trigger or induce batman-adv claim handling that causes ARP-related processing through the selected primary hard interface.
4. Race that processing against detachment or removal of the hard interface from the mesh interface.
5. Cause the kernel to dereference a NULL mesh interface pointer.
6. Result in a kernel oops, service disruption, or system crash depending on kernel configuration and panic-on-oops behavior.

How to detect it

Look for evidence of prior kernel crashes or oops events involving batman-adv, bridge loop avoidance, NULL-pointer dereferences, or ARP claim handling. Relevant log sources include `dmesg`, journald (`journalctl -k`), `/var/log/kern.log`, `/var/log/messages`, `/var/log/syslog`, crash dump repositories such as kdump/vmcore, appliance diagnostic bundles, and centralized SIEM ingestion of kernel logs. Search around crash timestamps for interface teardown, link deletion, module unload, batman-adv mesh interface changes, or repeated network reconfiguration events immediately before the oops. Because this vulnerability primarily produces denial-of-service symptoms rather than persistent compromise, expect artifacts such as kernel panic/oops records, unexpected reboots, watchdog resets, vmcore files, and batman-adv stack traces rather than malware indicators. If threat hunting across fleets, correlate kernel crash events with hosts where `batman_adv` was loaded or batman mesh interfaces were active.

• batman_adv
• batman-adv
• BUG: kernel NULL pointer dereference
• Oops: 0000
• NULL pointer dereference
• kernel NULL pointer dereference
• batadv
• bat0
• bridge loop avoidance
• BLA
• batadv_bla
• batadv_bla_send_claim
• batadv_bla_send_announce
• batadv_bla_claim
• Unable to handle kernel NULL pointer dereference
• Kernel panic - not syncing
• /proc/vmcore
• /var/crash
• /sys/module/batman_adv

What your security team should do

• Inventory Linux systems, appliances, embedded devices, and mesh-network nodes that run the batman-adv kernel module.
• Prioritize patching systems where batman-adv is active, especially devices providing critical mesh connectivity or operating in untrusted physical or network environments.
• Apply vendor-provided kernel updates that include the batman-adv fix, and reboot systems where required for the fixed kernel to take effect.
• Where batman-adv is not needed, disable or blacklist the module to remove attack surface.
• Restrict administrative and automation access capable of adding, removing, or reconfiguring network interfaces on affected systems.
• Add monitoring for kernel oops, NULL-pointer dereference, and batman-adv crash strings in system logs.
• For high-availability mesh deployments, test patch rollout in a representative environment before broad deployment to avoid operational regressions.