CVE-2026-64218

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the batman-adv module where the batadv bla purge backbone gw() function fails to properly handle report work when removing stale backbone gateway entries. If report work is running, the system may attempt to free the backbone gw before the worker finishes, potentially leading to the worker accessing freed memory, such as bat priv. Additionally, if report work is pending, the system fails to cancel it and release the associated reference. The previous implementation incorrectly called hlist for each entry safe() within a spin lock bh() section, which is problematic because cancel work sync() can sleep and cannot be executed within a spinlock-protected region.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.