CVE-2026-64094: batman-adv: bla: avoid NULL-ptr deref for claim via dropped interface

Q: What access does an attacker need to exploit this issue?

The CVSS vector indicates local access and low privileges are required. No user interaction is required.

Q: What is the likely impact of successful exploitation?

The issue can cause a NULL-pointer dereference, with availability impact rated High. The provided CVSS vector indicates no confidentiality or integrity impact.

Q: Under what condition does the vulnerable path occur?

It occurs when a batman-adv hard interface is obtained as a mesh interface's primary interface and is then decoupled from that mesh interface while it is being used. The hard interface's mesh-interface pointer can become NULL before an ARP request is sent.

Q: Is a fix available?

Yes. A patch is available, with stable kernel references provided for the resolved change.

Published Jul 19, 2026

Updated

In the Linux kernel, the following vulnerability has been resolved:

batman-adv: bla: avoid NULL-ptr deref for claim via dropped interface

Without rtnllock held, a hardif might be retrieved as primary interface of a meshif, but then (while operating on this interface) getting decoupled from the mesh interface. In this case, the meshif still exists but the pointer from the primary hardif to the meshif is set to NULL.

The meshiface must be checked first to be non-NULL before continuing to send an ARP request using meshif.

Affected Software

12 affected components

Linux Kernel

Linux Linux kernel>=3.5<5.10.259

Linux Linux kernel>=5.11<5.15.210

Linux Linux kernel>=5.16<6.1.176

Linux Linux kernel>=6.2<6.6.143

Linux Linux kernel>=6.7<6.12.93

Linux Linux kernel>=6.13<6.18.34

Linux Linux kernel>=6.19<7.0.11

Linux Linux kernel=7.1-rc1

Linux Linux kernel=7.1-rc2

Linux Linux kernel=7.1-rc3

Linux Linux kernel=7.1-rc4

Remediation

Event History

Jul 19, 2026

CVE Published

via MITRE·03:40 PM

Data Sourced

via MITRE·03:40 PM

Description

Data Sourced

via NVD·04:17 PM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What access does an attacker need to exploit this issue?

The CVSS vector indicates local access and low privileges are required. No user interaction is required.

What is the likely impact of successful exploitation?

The issue can cause a NULL-pointer dereference, with availability impact rated High. The provided CVSS vector indicates no confidentiality or integrity impact.

Under what condition does the vulnerable path occur?

It occurs when a batman-adv hard interface is obtained as a mesh interface's primary interface and is then decoupled from that mesh interface while it is being used. The hard interface's mesh-interface pointer can become NULL before an ARP request is sent.

Is a fix available?

Yes. A patch is available, with stable kernel references provided for the resolved change.

CVE-2026-64094: batman-adv: bla: avoid NULL-ptr deref for claim via dropped interface

Affected Software

Remediation

Patch Available

Patch Available

Patch Available

Patch Available

Patch Available

Patch Available

Patch Available

Patch Available

Event History

Frequently Asked Questions

What access does an attacker need to exploit this issue?

What is the likely impact of successful exploitation?

Under what condition does the vulnerable path occur?

Is a fix available?

Company

Resources

Contact

Frequently Asked Questions

What access does an attacker need to exploit this issue?

What is the likely impact of successful exploitation?

Under what condition does the vulnerable path occur?

Is a fix available?