CVE-2026-64096: batman-adv: mcast: fix use-after-free in orig_node RCU release
In the Linux kernel, the following vulnerability has been resolved:
batman-adv: mcast: fix use-after-free in orignode RCU release
batadvmcastpurgeorig() removes entries from RCU-protected hlists but does not wait for an RCU grace period before returning. Concurrent RCU readers may still accesses references to those entries at the point of removal. RCU-protected readers trying to operate on entries like orig->mcastwantallipv6node will then access already freed memory.
Fix this by moving batadvmcastpurgeorig() to batadvorignoderelease(), just before the callrcu() invocation. This ensures RCU readers that were active at purge time have drained before the orignode memory is reclaimed.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Move batadv_mcast_purge_orig() into batadv_orig_node_release() so that orig_node memory is reclaimed only after RCU-protected readers active at purge time have drained (RCU grace period).
batman-adv (Linux kernel) RCU release ordering for orig_node = Ensure orig_node memory reclamation waits for an RCU grace period after removing RCU-protected entries
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems running a Linux kernel with batman-adv multicast functionality are the relevant population. Exploitation requires access to the adjacent network, as indicated by the CVSS attack vector.
Does exploitation require credentials or user interaction?
No. The CVSS vector specifies no privileges required and no user interaction, with low attack complexity.
What is the impact if the flaw is exploited?
The vulnerability is rated high severity with a CVSS 3.1 score of 8.8. The provided vector indicates high impact to confidentiality, integrity, and availability.
What changes in the fix prevent the use-after-free?
The fix moves multicast-originator cleanup to the originator-node release path immediately before call_rcu(). This ensures readers active when entries are purged have completed before the originator-node memory is reclaimed.