Linux kernel batman-adv CVE-2026-64096

Vendor-released patch: update to a fixed stable kernel - 5.10.258, 5.15.209, 6.1.175, 6.6.142, 6.12.92, 6.18.34, 7.0.11, or mainline 7.1 or later, matching your kernel series; the fix moves batadv_mcast_purge_orig() into batadv_orig_node_release() before call_rcu(). Apply the corresponding git.kernel.org stable commit (e.g., https://git.kernel.org/stable/c/ff3a4487ead475e27b43280b8ee3d8464fe280e1) if you build custom kernels, and consult https://nvd.nist.gov/vuln/detail/CVE-2026-64096 for the full commit set. If immediate patching is not possible and batman-adv is not required, unload/disable the batman-adv module (rmmod batman_adv or blacklist it) to remove the vulnerable code path entirely - the trade-off is loss of mesh routing on that node. Where the mesh is needed, restrict which nodes can join the batman-adv network (Layer-2 access control, WPA-protected mesh links, and trusted-peer segmentation) so only trusted adjacent devices can reach the vulnerable multicast handling; this reduces exposure but does not fix the underlying race.