GHSA-HC2G-7M28-VW77

Vulnerability from github – Published: 2026-07-19 18:31 – Updated: 2026-07-19 18:31
VLAI
Details

In the Linux kernel, the following vulnerability has been resolved:

batman-adv: tp_meter: fix tp_vars reference leak in receiver shutdown

The receiver shutdown timer handler, batadv_tp_receiver_shutdown(), is responsible for releasing the tp_vars reference it holds. However, the existing logic for coordinating this release with batadv_tp_stop_all() was flawed.

timer_shutdown_sync() guarantees the timer will not fire again after it returns, but it returns non-zero only when the timer was pending at the time of the call. If the timer had already expired (and batadv_tp_stop_all() would unsucessfully try to rearm itself), batadv_tp_stop_all() skips its batadv_tp_vars_put(), and batadv_tp_receiver_shutdown() fails to put its own reference as well.

Fix this by introducing a new atomic variable receiving that is set to 1 when the receiver is initialized and cleared atomically with atomic_xchg() by whichever side claims it first. Only the side that observes the transition from 1 to 0 is responsible for releasing the tp_vars timer reference, eliminating the uncertainty.

Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-64092"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-19T16:17:50Z",
    "severity": null
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nbatman-adv: tp_meter: fix tp_vars reference leak in receiver shutdown\n\nThe receiver shutdown timer handler, batadv_tp_receiver_shutdown(), is\nresponsible for releasing the tp_vars reference it holds. However, the\nexisting logic for coordinating this release with batadv_tp_stop_all() was\nflawed.\n\ntimer_shutdown_sync() guarantees the timer will not fire again after it\nreturns, but it returns non-zero only when the timer was pending at the\ntime of the call. If the timer had already expired (and\nbatadv_tp_stop_all() would unsucessfully try to  rearm itself),\nbatadv_tp_stop_all() skips its batadv_tp_vars_put(), and\nbatadv_tp_receiver_shutdown() fails to put its own reference as well.\n\nFix this by introducing a new atomic variable receiving that is set to 1\nwhen the receiver is initialized and cleared atomically with atomic_xchg()\nby whichever side claims it first. Only the side that observes the\ntransition from 1 to 0 is responsible for releasing the tp_vars timer\nreference, eliminating the uncertainty.",
  "id": "GHSA-hc2g-7m28-vw77",
  "modified": "2026-07-19T18:31:52Z",
  "published": "2026-07-19T18:31:51Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-64092"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/0b1bedf114ea93fef929b31f0d70a9eedcc601de"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/297e1bc4a915b7cd3e65a79ed906b23fb3d7aaae"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/77098e4bea37af51d3962efa88a5af2ea5e1ac57"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/7715c73f33260af724d734c41b794457e9be8dbc"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/a9f0bfd624ee8a286d6fd2bf0f796e730efb49b0"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/b285bc0a97f43823a4967fb6d286de4c7f53d541"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/d078501dde9b57210f1808cdef4b59463d1f5fc8"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.