Skip to main content

Linux Kernel CVE-2026-64094

| EUVDEUVD-2026-45779 MEDIUM
NULL Pointer Dereference (CWE-476)
2026-07-19 Linux GHSA-7pc5-4w4m-mhg6
Denial Of Service Linux Null Pointer Dereference Red Hat Suse
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
4.7 MEDIUM

Race condition requires precise timing to win the decoupling window; AC:H better reflects the exploit constraint than the vendor-assigned AC:L.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 11, 2026 - 22:52 vuln.today
CVSS changed
Aug 11, 2026 - 16:22 NVD
5.5 (MEDIUM)
Patch available
Jul 19, 2026 - 17:03 EUVD
CVE Published
Jul 19, 2026 - 15:40 cve.org
UNKNOWN (no severity yet)
CVE Published
Jul 19, 2026 - 15:40 nvd
MEDIUM 5.5

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

batman-adv: bla: avoid NULL-ptr deref for claim via dropped interface

Without rtnl_lock held, a hardif might be retrieved as primary interface of a meshif, but then (while operating on this interface) getting decoupled from the mesh interface. In this case, the meshif still exists but the pointer from the primary hardif to the meshif is set to NULL.

The mesh_iface must be checked first to be non-NULL before continuing to send an ARP request using meshif.

AnalysisAI

NULL pointer dereference in the Linux kernel's batman-adv Bridge Loop Avoidance (BLA) subsystem crashes the kernel when a hard interface is concurrently decoupled from its mesh interface during ARP processing. Local users with low privileges on systems running batman-adv mesh networking can trigger a kernel panic, causing a full denial of service. No public exploit exists and EPSS stands at 0.21% (11th percentile), marking this as a low-urgency stability fix rather than an active threat.

Technical ContextAI

The batman-adv (Better Approach To Mobile Adhoc Networking, advanced) subsystem implements a layer-2 mesh networking protocol inside the Linux kernel. Its BLA (Bridge Loop Avoidance) component intercepts and processes ARP requests across mesh interfaces. The vulnerability is a CWE-476 (NULL Pointer Dereference) race condition: a hard interface (hardif) is retrieved as the primary interface of a mesh interface without holding rtnl_lock (the kernel routing/netlink serialization lock). A concurrent operation can decouple the hardif from the meshif during this window, nullifying the mesh_iface pointer. When the code then attempts to send an ARP request through that NULL meshif pointer, a kernel panic results. The fix adds a mandatory non-NULL guard on mesh_iface before proceeding. Affected CPE: cpe:2.3:a:linux:linux:*, introduced from commit 23721387c409087fd3b97e274f34d3ddc0970b74.

RemediationAI

Update the Linux kernel to one of the patched stable releases: 5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.93, 6.18.34, 7.0.11, or 7.1. The individual upstream fix commits are published at git.kernel.org/stable (see references: 4f6266735a0b, 53cb3511f6ed, efb62458c94d, 2a8c9e865291, 0f3ebd7bb417, 6921a7683ae9, 555b8d3f5c31, f80d3d98d2ff). Ubuntu users should apply the update referenced in USN-8593-1. If immediate kernel patching is not feasible and batman-adv is not operationally required, unloading the batman-adv module (rmmod batman_adv) eliminates the attack surface entirely, though this disables all batman-adv mesh networking functionality. Restricting CAP_NET_ADMIN to trusted administrators limits who can manipulate the interface state involved in the race, but does not eliminate the vulnerability if batman-adv remains active and accessible.

Same weakness CWE-476 – NULL Pointer Dereference

View all
CVE-2016-0742 HIGH
7.5
CVE-2014-3470 MEDIUM
4.3
CVE-2017-3730 HIGH POC
7.5
CVE-2017-3169 CRITICAL POC
9.8
CVE-2016-4957 HIGH
7.5
CVE-2015-3194 HIGH
7.5
CVE-2026-21525 MEDIUM
6.2
CVE-2017-0016 MEDIUM
5.9

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2026-64094 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy