CVE-2026-64092: batman-adv: tp_meter: fix tp_vars reference leak in receiver shutdown
In the Linux kernel, the following vulnerability has been resolved:
batman-adv: tpmeter: fix tpvars reference leak in receiver shutdown
The receiver shutdown timer handler, batadvtpreceivershutdown(), is responsible for releasing the tpvars reference it holds. However, the existing logic for coordinating this release with batadvtpstopall() was flawed.
timershutdownsync() guarantees the timer will not fire again after it returns, but it returns non-zero only when the timer was pending at the time of the call. If the timer had already expired (and batadvtpstopall() would unsucessfully try to rearm itself), batadvtpstopall() skips its batadvtpvarsput(), and batadvtpreceivershutdown() fails to put its own reference as well.
Fix this by introducing a new atomic variable receiving that is set to 1 when the receiver is initialized and cleared atomically with atomicxchg() by whichever side claims it first. Only the side that observes the transition from 1 to 0 is responsible for releasing the tpvars timer reference, eliminating the uncertainty.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Update batman-adv tp_meter code to fix the tp_vars reference leak in receiver shutdown by atomically coordinating shutdown/release: initialize a new atomic variable (receiving) to 1, and clear it atomically using atomic_xchg() such that only the side that transitions from 1 to 0 releases the tp_vars timer/reference.
Linux kernel (batman-adv: tp_meter) atomic variable/atomic_xchg = Introduce new atomic variable receiving that is set to 1; clear the receiver shutdown state atomically with atomic_xchg() so the side transitioning from 1 to 0 releases the tp_vars reference.