CVE-2026-64218: batman-adv: bla: fix report_work leak on backbone_gw purge
In the Linux kernel, the following vulnerability has been resolved:
batman-adv: bla: fix reportwork leak on backbonegw purge
batadvblapurgebackbonegw() removes stale backbone gateway entries, but fails to properly handle their associated reportwork:
- If reportwork is running, the purge must wait for it to finish before freeing the backbonegw, otherwise the worker may access freed memory (e.g. batpriv). - If reportwork is pending, the purge must cancel it and release the reference held for that pending work item.
The previous implementation called hlistforeachentrysafe() inside a spinlockbh() section, but cancelworksync() may sleep and therefore cannot be called from within a spinlock-protected region.
Restructure the loop to handle one entry per spinlock critical section: acquire the lock, find the next entry to purge, remove it from the hash list, then release the lock before calling cancelworksync() and dropping the hashentry reference. Repeat until no more entries require purging.
Affected Software
Remediation
Event History
Frequently Asked Questions
Who is exposed and what access does an attacker need?
Systems using the Linux kernel's batman-adv component are the relevant population. Exploitation requires local access and low privileges; no user interaction is required.
What condition triggers the vulnerability?
The flaw occurs when stale backbone gateway entries are purged while their associated report_work is running or pending. A running worker can access freed memory, while pending work must be cancelled and its held reference released.
What should be done to remediate the issue?
Apply the available Linux kernel patch. The remediation changes backbone gateway purging so entries are removed under the spinlock, then report_work is cancelled and references are released after the lock is dropped.