CVE-2026-64218

What it actually does

This is a use-after-free flaw in the Linux kernel batman-adv mesh networking subsystem, specifically in Bridge Loop Avoidance backbone gateway cleanup. When stale backbone gateway entries are purged, associated report_work workqueue items may still be running or pending while the gateway object is removed and freed. A worker can then dereference freed kernel memory, potentially causing kernel memory corruption, a crash, or, under favorable conditions, local privilege escalation. The CVSS vector indicates local access with low attack complexity and low privileges required, no user interaction, and high confidentiality, integrity, and availability impact.

Why it matters to the business

Systems using the batman-adv kernel module for mesh networking could be exposed to local denial of service or privilege escalation by a user or compromised low-privilege process. In operational terms, exploitation could crash affected Linux hosts or allow an attacker who already has limited local access to gain deeper control. The issue is not currently listed in CISA KEV, has no known ransomware association, and has a low EPSS score, so broad active exploitation is not indicated; however, kernel privilege escalation bugs should still be prioritized on systems where batman-adv is enabled or loadable.

How an attack unfolds

An attacker first needs local access to a Linux system where the batman-adv subsystem is present and usable. They then trigger batman-adv Bridge Loop Avoidance state changes that cause stale backbone gateway entries to be purged while their associated report_work item is pending or executing. Because the vulnerable cleanup path can remove and free the backbone gateway object before the work item is safely canceled or completed, the workqueue code may later access freed memory. Depending on timing, kernel configuration, heap layout, and available primitives, this may result in a kernel crash or could potentially be shaped into memory corruption useful for privilege escalation. Exploitation is expected to be race-condition dependent and environment-specific, and no public mature exploit is indicated by the supplied metadata.

How to fix it

Apply a Linux kernel update that includes the batman-adv fix for proper report_work cancellation and synchronization during backbone gateway purge. If using a distribution kernel, install the vendor-provided security update when available rather than attempting to patch manually. If exact fixed package versions are not yet available, track the relevant upstream and distribution advisories for CVE-2026-64218 and deploy the first kernel build containing the backport. Reboot systems after kernel updates to ensure the fixed kernel is running. As a mitigation where patching is delayed, disable or prevent loading of the batman-adv module on systems that do not require it, restrict local shell access, and limit privileges capable of creating or manipulating batman-adv interfaces and mesh networking configuration.

How to confirm the fix worked

Confirm the running kernel is a vendor build that includes the fix, not only that an updated package is installed. Check the active kernel version after reboot with standard OS tooling and compare it against the distribution advisory for this issue. Verify whether batman-adv is loaded with module inspection tools and confirm it is disabled or blocked on systems where it is not required. For source-based or custom kernels, confirm the batman-adv cleanup path cancels pending report_work outside the spinlock-protected section and waits for running work before freeing the associated backbone gateway object. Also review kernel logs after validation testing for absence of batman-adv-related use-after-free, KASAN, Oops, or workqueue crash messages.

Typical attack path

1. Obtain low-privilege local access to an affected Linux host.
2. Confirm the batman-adv kernel module is present, enabled, or loadable.
3. Create or manipulate batman-adv mesh networking and Bridge Loop Avoidance state so backbone gateway entries become stale.
4. Trigger purge behavior while associated report_work workqueue items are pending or running.
5. Race cleanup against workqueue execution to cause access to freed kernel memory.
6. Leverage the resulting memory corruption for kernel crash or possible privilege escalation, depending on exploit reliability and system hardening.

How to detect it

To determine whether this was already exploited or triggered, review kernel and system logs for crashes or memory-safety reports involving batman-adv, Bridge Loop Avoidance, backbone gateway purge, workqueues, or report_work. Relevant sources include journald, syslog, kern.log, dmesg archives, crash dumps, kdump/vmcore data, kernel panic records, EDR telemetry for local privilege escalation attempts, and audit logs showing users or processes creating or modifying batman-adv interfaces. Look for repeated module loading, mesh interface creation, abnormal local network-configuration commands, and kernel faults near batadv_bla_purge_backbone_gw or report_work execution. Because successful exploitation may leave few durable artifacts beyond kernel instability or a privilege transition, correlate suspicious local user activity with kernel Oops/panic events and unexpected root shells, setuid file creation, credential access, or security control tampering shortly before or after batman-adv-related crashes.

• batman_adv
• batadv
• batadv_bla_purge_backbone_gw
• report_work
• backbone_gw
• Bridge Loop Avoidance
• BLA
• BUG: KASAN: use-after-free
• use-after-free in batadv
• kernel BUG
• general protection fault
• Oops:
• Call Trace:
• workqueue:
• /sys/module/batman_adv
• modprobe batman-adv
• modprobe batman_adv
• ip link add name bat0 type batadv
• batctl

What your security team should do

• Identify Linux systems where the batman-adv module is loaded, enabled, or available for use, prioritizing mesh networking, embedded, lab, wireless, and specialized network systems.
• Patch affected systems with the first vendor kernel update containing the fix, and ensure systems are rebooted into the fixed kernel.
• If batman-adv is not required, disable or blacklist the batman_adv module to reduce attack surface.
• Restrict local access and administrative/network configuration capabilities on systems where batman-adv must remain enabled.
• Monitor kernel logs for batman-adv, workqueue, KASAN, Oops, panic, or general protection fault messages that may indicate attempted triggering or instability.
• Track distribution advisories because no exact fixed package versions were supplied, and update remediation instructions when vendor-specific fixed versions become available.