Linux Kernel EUVD-2026-45778

batman-adv is an in-kernel Layer-2 mesh routing protocol (net/batman-adv) that operates over adjacent broadcast domains. The affected component, tp_meter, is its built-in throughput-measurement facility, which uses kernel timers to retransmit and to reset sender state as ACKs arrive. The root cause is a timer-lifetime use-after-free race (CWE-416 combined with CWE-362, listed as N/A in the feed): batadv_tp_sender_cleanup() previously used timer_delete_sync() followed by timer_delete() as a hack to defeat a handler that could re-arm itself, relying on the sending status being cleared to 0 to suppress re-arming. Because that suppression was conditional, a concurrent batadv_tp_recv_ack() path in batadv_tp_reset_sender_timer() could observe sending==1, then re-arm the timer after batadv_tp_sender_shutdown() had already set sending to 0 and forced the kthread to tear the timer down - leaving a dangling timer reference. The fix replaces both calls with a single timer_shutdown_sync(), which waits for any running callback and permanently disarms the timer so it cannot be re-armed, making the guarantee unconditional. The two CPE entries only identify 'linux:linux' generically and do not pin the module.