CVE-2026-64096

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A use-after-free issue exists in the batman-adv module. The batadv mcast purge orig() function removes entries from RCU-protected hlists without waiting for an RCU grace period. This allows concurrent RCU readers to access references to entries at the time of removal, leading to the access of freed memory when operating on entries such as orig->mcast want all ipv6 node. RCU (Read-Copy-Update) is a synchronization mechanism that allows multiple readers to access data while it is being updated.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.