Skip to main content

Linux Kernel CVE-2026-64091

| EUVDEUVD-2026-45776 CRITICAL
Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367)
2026-07-19 Linux GHSA-r4m5-xwcp-9p7w
Information Disclosure Linux
9.8
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
6.4 MEDIUM

batman-adv is L2, so AV:A; a TOCTOU race must be won (AC:H); no mesh auth (PR:N); realistic impact is crash/memory leak (A:H, C:L/I:L).

3.1 AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H
4.0 AV:A/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N
SUSE
8.1 HIGH
AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jul 20, 2026 - 17:22 vuln.today
CVSS changed
Jul 20, 2026 - 15:22 NVD
9.8 (CRITICAL)
Patch available
Jul 19, 2026 - 17:03 EUVD
CVE Published
Jul 19, 2026 - 15:40 cve.org
UNKNOWN (no severity yet)
CVE Published
Jul 19, 2026 - 15:40 cve.org
CRITICAL 9.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

batman-adv: tt: fix TOCTOU race for reported vlans

The local TT based TVLV is generated by first checking the number of VLANs which have at least one TT entry. A new buffer with the correct size for the VLANs is then allocated. Only then, the list of VLANs s used to fill the VLAN entries in the buffer. During this time, the meshif_vlan_list_lock is held. But the actual number of TT entries of each VLAN can still increase during this time - just not the number of VLANs in the list.

But the prefilter used in the buffer size calculation might still cause an increase of the number of VLANs which need to be stored. Simply because a VLAN might now suddenly have at least one entry when it had none in the pre-alloc check - and then needs to occupy space which was not allocated.

It is better to overestimate the buffer size at the beginning and then fill the buffer only with the VLANs which are not empty.

AnalysisAI

Heap buffer overflow in the Linux kernel's batman-adv mesh networking subsystem (translation-table TVLV generation) lets the number of non-empty VLANs grow between a pre-allocation size check and the buffer fill, so a VLAN that gained its first TT entry during that window is written past the allocated buffer. The flaw affects nodes running batman-adv mesh with VLANs and can corrupt kernel heap memory, most realistically causing a crash or information leak (tagged Information Disclosure). It is not in CISA KEV, has no public exploit identified at time of analysis, and carries a low EPSS of 0.18% (8th percentile) despite the automated CVSS 9.8.

Technical ContextAI

batman-adv (B.A.T.M.A.N. Advanced) is an OSI layer-2 mesh routing protocol shipped in the mainline Linux kernel that distributes host/MAC reachability via a distributed Translation Table (TT), announced to peers using TVLV containers. The local TT TVLV is built in two passes under meshif_vlan_list_lock: first it counts VLANs that have at least one TT entry to size a buffer, then it walks the VLAN list to fill entries. The lock protects the count of VLANs in the list but NOT the per-VLAN TT entry counters, which can still increment from concurrent mesh activity - so a VLAN empty at check time can become non-empty at fill time and require space that was never allocated. This is a classic Time-Of-Check-To-Time-Of-Use (CWE-367) race producing an out-of-bounds heap write (CWE-787/CWE-122); the input reports CWE as N/A. Affected CPE is cpe:2.3:a:linux:linux, i.e. the kernel itself, but only when CONFIG_BATMAN_ADV and mesh/VLAN operation are active.

RemediationAI

Vendor-released patch: update to a fixed stable kernel - 5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.93, 6.18.34, or mainline 7.x or later - per your distribution's build; the upstream fix over-allocates the buffer and then fills only non-empty VLANs (commit 724a8eb4155669797c96b70d70e354284ae3b5a8 and stable backports). If you cannot patch immediately and do not use mesh networking, unload or blacklist the module (rmmod batman_adv / add to modprobe blacklist) to remove the code path entirely - side effect: this disables any batman-adv mesh in use. Where batman-adv is required, restrict which nodes can join the mesh (authenticated/encrypted L2 segment, trusted-peer bridging only) to reduce an adjacent attacker's ability to rapidly inject TT entries and win the race - trade-off is added mesh management overhead and no full elimination of the local race. Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-64091.

Same weakness CWE-367 – Time-of-check Time-of-use (TOCTOU) Race Condition

View all
CVE-2024-30088 HIGH POC
7.0
CVE-2025-22224 CRITICAL
9.3
CVE-2025-38352 HIGH POC
7.8
CVE-2022-48618 HIGH
7.0
CVE-2023-38146 HIGH POC
8.8
CVE-2025-34027 CRITICAL POC
10.0
CVE-2020-1337 HIGH POC
7.8
CVE-2026-25641 CRITICAL POC
10.0

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2026-64091 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy