CVE-2026-64096

What it actually does

This is a use-after-free vulnerability in the Linux kernel BATMAN Advanced (batman-adv) mesh networking subsystem. The vulnerable multicast cleanup path removes originator multicast entries from RCU-protected hash lists without ensuring that concurrent RCU readers have finished using those entries. A nearby network attacker able to interact with a BATMAN-adv mesh segment could trigger originator and multicast state changes that cause the kernel to access freed memory. Depending on kernel configuration, heap state, and exploit reliability, the result could be kernel crash, memory corruption, or potentially arbitrary kernel-level code execution.

Why it matters to the business

Systems using Linux batman-adv for layer-2 mesh networking could be remotely disrupted by an attacker on the same adjacent network or mesh segment, potentially causing outages for mesh-connected devices, routers, gateways, industrial/IoT deployments, or community wireless infrastructure. The issue has a high CVSS score because successful exploitation can affect confidentiality, integrity, and availability at the kernel level, but current public exploitation signals are low: it is not listed in CISA KEV, is not known to be used in ransomware campaigns, and has a low EPSS score. Organizations that do not use batman-adv have substantially lower practical exposure but should still patch as part of normal kernel maintenance.

How an attack unfolds

An attacker first needs network adjacency to a system participating in or processing BATMAN-adv traffic, such as being on the same mesh or layer-2 broadcast domain. The attacker then sends traffic or induces topology/multicast membership changes that create and remove BATMAN-adv originator multicast state. By repeatedly causing originator cleanup while legitimate or attacker-triggered RCU readers still reference multicast list entries, the attacker attempts to win a race where freed memory is reused while still being accessed by the kernel. A reliable exploit would shape kernel heap allocation and timing so the stale pointer references attacker-influenced data, leading to memory corruption. In less controlled cases, exploitation is more likely to produce kernel warnings, crashes, soft lockups, or device reboots.

How to fix it

Upgrade to a Linux kernel version that contains the upstream batman-adv fix for moving multicast originator purge handling into the originator RCU release path. Because no exact fixed package versions were provided, use your operating system vendor’s kernel advisory and install the latest fixed kernel available for the relevant distribution or appliance firmware. Reboot into the fixed kernel after installation; simply installing a kernel package is not sufficient if the running kernel remains vulnerable. If batman-adv is not required, disable or unload the batman-adv module and prevent it from autoloading. Where immediate patching is not possible, reduce exposure by restricting access to BATMAN-adv mesh interfaces, limiting untrusted layer-2 adjacency, segmenting mesh networks, and monitoring for abnormal topology churn or kernel instability.

How to confirm the fix worked

Confirm the running kernel, not just the installed package, has been updated to a vendor build containing the fix. Check whether batman-adv is loaded with commands such as `lsmod | grep batman_adv` or by inspecting `/sys/module/batman_adv`. Validate that systems not requiring the feature cannot load it, for example through module blacklist configuration and reboot testing. Review vendor kernel changelogs or package metadata for the batman-adv multicast RCU/originator release fix. After patching and rebooting, monitor kernel logs for absence of new batman-adv use-after-free, RCU, KASAN, page fault, general protection fault, or panic messages during normal mesh operation or controlled BATMAN-adv topology-change testing.

Typical attack path

1. Identify Linux systems using the batman-adv kernel module or participating in a BATMAN-adv mesh network.
2. Gain adjacency to the same layer-2 segment, wireless mesh, or virtual network where BATMAN-adv frames are accepted.
3. Generate BATMAN-adv originator and multicast state changes, especially involving originator removal or churn.
4. Race concurrent RCU readers against multicast originator cleanup to trigger access to freed memory.
5. Attempt to convert the resulting kernel memory corruption into denial of service or kernel-level code execution.

How to detect it

Retrospective detection should focus on systems that had the batman-adv module loaded and were reachable from an adjacent mesh or layer-2 network. Review kernel logs, persistent journal entries, crash dumps, and monitoring alerts for kernel memory-safety symptoms involving batman-adv multicast or originator handling. Useful sources include `dmesg`, `/var/log/kern.log`, `/var/log/messages`, `journalctl -k`, pstore/ramoops records, kdump vmcores, hypervisor reset logs for virtual systems, and network monitoring for abnormal BATMAN-adv topology churn. Look for KASAN use-after-free reports, RCU stall warnings, general protection faults, page faults, kernel panics, or call traces containing batman-adv multicast/originator functions. Absence of logs does not prove absence of exploitation because successful kernel exploitation may suppress artifacts, and many embedded devices have limited log retention.

• batman_adv
• batadv_mcast_purge_orig
• batadv_orig_node_release
• mcast_want_all_ipv6_node
• mcast_want_all_ipv4_node
• BUG: KASAN: use-after-free
• use-after-free in batadv
• general protection fault
• kernel BUG at net/batman-adv
• Call Trace:
• RCU stall
• rcu_sched detected stalls
• Unable to handle kernel paging request
• Oops:
• Kernel panic - not syncing
• /sys/module/batman_adv
• /proc/net/batman_adv
• /sys/kernel/debug/batman_adv

What your security team should do

• Prioritize patching systems that load batman-adv or participate in BATMAN-adv mesh networks, especially routers, gateways, embedded Linux devices, wireless mesh nodes, and virtualization hosts using mesh overlays.
• Inventory exposure by searching for loaded batman-adv modules and BATMAN-adv interfaces across Linux fleets.
• If batman-adv is unnecessary, disable the module and block autoloading as a compensating control.
• Restrict untrusted devices from joining mesh or adjacent layer-2 networks where BATMAN-adv traffic is processed.
• Collect and retain kernel logs from exposed systems to support post-patch review for crashes, RCU stalls, KASAN reports, or suspicious topology churn.
• Track distribution-specific advisories because fixed versions vary by kernel branch and vendor backport policy.
• Treat unexplained kernel crashes on batman-adv-enabled systems as potentially security-relevant until logs and crash dumps are reviewed.