{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-64095","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2026-07-19T07:54:57.033Z","datePublished":"2026-07-19T15:40:02.360Z","dateUpdated":"2026-08-05T12:39:09.386Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-05T12:39:09.386Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbatman-adv: bla: avoid double decrement of bla.num_requests\n\nThe bla.num_requests is increased when no request_sent was in progress. And\nit is decremented in various places (announcement was received, backbone is\npurged, periodic work). But the check if the request_sent is actually set\nto a specific state and the atomic_dec/_inc are not safe because they are\nnot atomic (TOCTOU) and multiple such code portions can run concurrently.\n\nAt the same time, it is necessary to modify request_sent (state) and\nbla.num_requests atomically. Otherwise batadv_bla_send_request() might set\nrequest_sent to 1 and is interrupted.  batadv_handle_announce() can then\nset request_sent back to 0 and decrement num_requests before\nbatadv_bla_send_request() incremented it.\n\nThe two operations must therefore be locked. And since state (request_sent)\nand wait_periods are only accessed inside this lock, they can be converted\nto simpler datatypes. And to avoid that the bla.num_requests is touched by\na parallel running context with a valid backbone_gw reference after\nbatadv_bla_purge_backbone_gw() ran, a third state \"stopped\" is required to\ncorrectly signal that a backbone_gw is in the state of being cleaned up."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","baseScore":7.1,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:A - The vulnerable BLA ANNOUNCE handling runs in batadv_bla_tx() when BLA ARP claim frames reach the batman-adv interface from an attached LAN segment, which is the intended BLA deployment (multiple mesh gateways on one Ethernet). This requires same-segment L2 adjacency, not arbitrary Internet reachability.\nAC:L - The TOCTOU race between request_sent checks and num_requests updates is attacker-influenceable by flooding crafted BLA ANNOUNCE frames with mismatched CRCs while concurrent periodic work and purge paths run. The attacker controls one side of the race via packet timing and volume.\nPR:N - Exploitation requires only the ability to inject valid BLA protocol frames onto the shared LAN or mesh segment as a peer backbone gateway, not root, CAP_NET_ADMIN, or any local privileges on the victim system.\nUI:N - No victim user action is required; the bug is triggered automatically when the attacker sends BLA frames that are processed by the victim's bridge-loop-avoidance code.\nS:U - The impact is confined to incorrect BLA state and packet forwarding on the victim's batman-adv mesh node within the same kernel/network security boundary, with no VM escape or cross-authority boundary crossing.\nC:N - The bug is an integer counter synchronization error with no out-of-bounds read, use-after-free, or other memory access that could disclose kernel data.\nI:L - A corrupted num_requests counter can prematurely clear the multicast gate and disable bridge-loop avoidance, allowing unintended broadcast forwarding and Ethernet bridge loops, but there is no kernel memory write or code-execution primitive.\nA:H - Counter underflow leaves num_requests permanently non-zero, indefinitely blocking all multicast/broadcast mesh traffic, and the opposite race can trigger sustained broadcast storms via bridge loops, causing total loss of mesh/LAN availability."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/batman-adv/bridge_loop_avoidance.c","net/batman-adv/mesh-interface.c","net/batman-adv/types.h"],"versions":[{"version":"23721387c409087fd3b97e274f34d3ddc0970b74","lessThan":"1f013bc94154f2e78e97d0296175664224c796e0","status":"affected","versionType":"git"},{"version":"23721387c409087fd3b97e274f34d3ddc0970b74","lessThan":"5328b95960774f2e189f22485616bc7b8eb2f7e3","status":"affected","versionType":"git"},{"version":"23721387c409087fd3b97e274f34d3ddc0970b74","lessThan":"8ff9c59d1b7b48c2596878341a5310f32895d52b","status":"affected","versionType":"git"},{"version":"23721387c409087fd3b97e274f34d3ddc0970b74","lessThan":"a9393751ecf7e9096f93cb6eed02db4f79125765","status":"affected","versionType":"git"},{"version":"23721387c409087fd3b97e274f34d3ddc0970b74","lessThan":"461f1e3dfb888701895b766446c55db2b10db705","status":"affected","versionType":"git"},{"version":"23721387c409087fd3b97e274f34d3ddc0970b74","lessThan":"45384612f29692fbf0c770200361a7acff90125c","status":"affected","versionType":"git"},{"version":"23721387c409087fd3b97e274f34d3ddc0970b74","lessThan":"65497ad155a3246df177b5ef662cd6e5a32cb470","status":"affected","versionType":"git"},{"version":"23721387c409087fd3b97e274f34d3ddc0970b74","lessThan":"83ab69bd12b80f6ea169c8bea6977701b53a043d","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/batman-adv/bridge_loop_avoidance.c","net/batman-adv/mesh-interface.c","net/batman-adv/types.h"],"versions":[{"version":"3.5","status":"affected"},{"version":"0","lessThan":"3.5","status":"unaffected","versionType":"semver"},{"version":"5.10.259","lessThanOrEqual":"5.10.*","status":"unaffected","versionType":"semver"},{"version":"5.15.210","lessThanOrEqual":"5.15.*","status":"unaffected","versionType":"semver"},{"version":"6.1.176","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.6.143","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.12.93","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.18.34","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"7.0.11","lessThanOrEqual":"7.0.*","status":"unaffected","versionType":"semver"},{"version":"7.1","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.5","versionEndExcluding":"5.10.259"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.5","versionEndExcluding":"5.15.210"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.5","versionEndExcluding":"6.1.176"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.5","versionEndExcluding":"6.6.143"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.5","versionEndExcluding":"6.12.93"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.5","versionEndExcluding":"6.18.34"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.5","versionEndExcluding":"7.0.11"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.5","versionEndExcluding":"7.1"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/1f013bc94154f2e78e97d0296175664224c796e0"},{"url":"https://git.kernel.org/stable/c/5328b95960774f2e189f22485616bc7b8eb2f7e3"},{"url":"https://git.kernel.org/stable/c/8ff9c59d1b7b48c2596878341a5310f32895d52b"},{"url":"https://git.kernel.org/stable/c/a9393751ecf7e9096f93cb6eed02db4f79125765"},{"url":"https://git.kernel.org/stable/c/461f1e3dfb888701895b766446c55db2b10db705"},{"url":"https://git.kernel.org/stable/c/45384612f29692fbf0c770200361a7acff90125c"},{"url":"https://git.kernel.org/stable/c/65497ad155a3246df177b5ef662cd6e5a32cb470"},{"url":"https://git.kernel.org/stable/c/83ab69bd12b80f6ea169c8bea6977701b53a043d"}],"title":"batman-adv: bla: avoid double decrement of bla.num_requests","x_generator":{"engine":"bippy-1.2.0"}}}}