{"id":"CVE-2026-64096","summary":"batman-adv: mcast: fix use-after-free in orig_node RCU release","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nbatman-adv: mcast: fix use-after-free in orig_node RCU release\n\nbatadv_mcast_purge_orig() removes entries from RCU-protected hlists but\ndoes not wait for an RCU grace period before returning. Concurrent RCU\nreaders may still accesses references to those entries at the point of\nremoval. RCU-protected readers trying to operate on entries like\norig-\u003emcast_want_all_ipv6_node will then access already freed memory.\n\nFix this by moving batadv_mcast_purge_orig() to batadv_orig_node_release(),\njust before the call_rcu() invocation. This ensures RCU readers that were\nactive at purge time have drained before the orig_node memory is reclaimed.","modified":"2026-07-22T03:31:36.412173494Z","published":"2026-07-19T15:40:02.969Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/64xxx/CVE-2026-64096.json","cna_assigner":"Linux"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/20c2d6a20ca936f5aaa6dd40f73f262ac45c87cc"},{"type":"WEB","url":"https://git.kernel.org/stable/c/70bcb678561f0fb58f33270fc73f12f3be72b878"},{"type":"WEB","url":"https://git.kernel.org/stable/c/78a63fb2f7d5630d1c1f2859a20d4e4226863b41"},{"type":"WEB","url":"https://git.kernel.org/stable/c/8a3707653ab658e082ccd992e92594e01b09a3fc"},{"type":"WEB","url":"https://git.kernel.org/stable/c/aef897c9d2dd0d9339167fb82b62beff68d076cb"},{"type":"WEB","url":"https://git.kernel.org/stable/c/ced48f55bac73f0822eae90509e51b42b4f646c8"},{"type":"WEB","url":"https://git.kernel.org/stable/c/edfb1e094104a50f931553dc82ac59246569fd32"},{"type":"WEB","url":"https://git.kernel.org/stable/c/ff3a4487ead475e27b43280b8ee3d8464fe280e1"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/64xxx/CVE-2026-64096.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64096"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"ab49886e3da73b6b35ece21006e191910427bb30"},{"fixed":"ff3a4487ead475e27b43280b8ee3d8464fe280e1"},{"fixed":"78a63fb2f7d5630d1c1f2859a20d4e4226863b41"},{"fixed":"ced48f55bac73f0822eae90509e51b42b4f646c8"},{"fixed":"70bcb678561f0fb58f33270fc73f12f3be72b878"},{"fixed":"aef897c9d2dd0d9339167fb82b62beff68d076cb"},{"fixed":"8a3707653ab658e082ccd992e92594e01b09a3fc"},{"fixed":"edfb1e094104a50f931553dc82ac59246569fd32"},{"fixed":"20c2d6a20ca936f5aaa6dd40f73f262ac45c87cc"}]}],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-64096.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.15.0"},{"fixed":"5.10.258"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.11.0"},{"fixed":"5.15.209"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.16.0"},{"fixed":"6.1.175"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.2.0"},{"fixed":"6.6.142"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0"},{"fixed":"6.12.92"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.18.34"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"7.0.11"}]}],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-64096.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}