Linux Kernel EUVD-2026-45780

Vendor-released patch: upgrade to a fixed stable kernel - 5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.93, 7.0.11, or 6.18.34 (or later on each branch), obtained from your distribution or from the git.kernel.org stable commits listed for CVE-2026-64095. The fix serializes request_sent state and bla.num_requests updates under a single lock and introduces a 'stopped' backbone_gw state to prevent parallel contexts from touching the counter during cleanup. If immediate patching is not possible, the most effective compensating control is to avoid the vulnerable code path: unload or blacklist the batman-adv module (e.g. do not modprobe batman-adv / add it to modprobe blacklist) on systems that do not require mesh networking - trade-off: this disables B.A.T.M.A.N. mesh routing entirely. Where batman-adv is required, restrict participation in the mesh to trusted nodes and isolate the mesh L2 segment from untrusted adjacent devices, since exploitation requires an attacker on the same mesh/adjacent network; the trade-off is operational overhead in vetting mesh peers and no protection against an already-trusted-but-compromised node. Reference advisories: https://nvd.nist.gov/vuln/detail/CVE-2026-64095 and the stable commits at https://git.kernel.org/stable/c/.