{"id":"CVE-2026-64093","summary":"batman-adv: tp_meter: directly shut down timer on cleanup","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nbatman-adv: tp_meter: directly shut down timer on cleanup\n\nbatadv_tp_sender_cleanup() was calling timer_delete_sync() followed by\ntimer_delete() to guard against the timer handler re-arming itself between\nthe two calls. This double-deletion hack relied on the sending status being\nset to 0 to suppress re-arming.\n\nReplace both calls with a single timer_shutdown_sync(). This function both\nwaits for any running timer callback to complete (like timer_delete_sync())\nand permanently disarms the timer so it cannot be re-armed afterwards,\nmaking re-arming prevention unconditional and self-documenting.\n\nThe re-arming property is also required because otherwise:\n\n1. context 0 (batadv_tp_recv_ack()) checks in\n   batadv_tp_reset_sender_timer() if sending is still 1 -\u003e it is\n2. context 1 changes in batadv_tp_sender_shutdown() sending to 0 and in\n   this process forces the kthread to stop timer in\n   batadv_tp_sender_cleanup()\n3. context 0 continues in batadv_tp_reset_sender_timer() and rearms the\n   timer -\u003e but the reference for it is already gone","modified":"2026-07-22T03:31:34.835990228Z","published":"2026-07-19T15:40:01.172Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/64xxx/CVE-2026-64093.json","cna_assigner":"Linux"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/00bf4bb9947b1190a8be8d9b6a1bcbfa3707785c"},{"type":"WEB","url":"https://git.kernel.org/stable/c/5bc2d50fb66b46f86543d5153a188eb1486d0b6e"},{"type":"WEB","url":"https://git.kernel.org/stable/c/74a76634055462833446684fd526d73c290ea43a"},{"type":"WEB","url":"https://git.kernel.org/stable/c/770bf0a35f0620b526fd4193889d1e77084e4c43"},{"type":"WEB","url":"https://git.kernel.org/stable/c/933880a8bc9b4042223a79255c0b1021cdc36991"},{"type":"WEB","url":"https://git.kernel.org/stable/c/d5487249a81ea658717614009c8f46acc5b7101a"},{"type":"WEB","url":"https://git.kernel.org/stable/c/f86b20ec8d17d77bddc02c5c86cfa2389d84ecff"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/64xxx/CVE-2026-64093.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64093"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"33a3bb4a3345bb511f9c69c913da95d4693e2a4e"},{"fixed":"00bf4bb9947b1190a8be8d9b6a1bcbfa3707785c"},{"fixed":"74a76634055462833446684fd526d73c290ea43a"},{"fixed":"5bc2d50fb66b46f86543d5153a188eb1486d0b6e"},{"fixed":"f86b20ec8d17d77bddc02c5c86cfa2389d84ecff"},{"fixed":"770bf0a35f0620b526fd4193889d1e77084e4c43"},{"fixed":"933880a8bc9b4042223a79255c0b1021cdc36991"},{"fixed":"d5487249a81ea658717614009c8f46acc5b7101a"}]}],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-64093.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.8.0"},{"fixed":"5.15.210"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.16.0"},{"fixed":"6.1.176"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.2.0"},{"fixed":"6.6.143"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0"},{"fixed":"6.12.93"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.18.34"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"7.0.11"}]}],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-64093.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}