In the Linux kernel, the following vulnerability has been resolved: batman-adv: bla: avoid double decrement of bla.num_requests The bla.num_requests… (CVE-2026-64095)
In the Linux kernel, the following vulnerability has been resolved: batman-adv: bla: avoid double decrement of bla.num_requests The bla.num_requests is increased when no request_sent was in progress. And it is decremented in various places (announcement was received, backbone is purged, periodic work). But the check if the request_sent is actually set to a specific state and the atomic_dec/_inc are not safe because they are not atomic (TOCTOU) and multiple such code portions can run concurrently. At the same time, it is necessary to modify request_sent (state) and bla.num_requests atomically. Otherwise batadv_bla_send_request() might set request_sent to 1 and is interrupted. batadv_handle_announce() can then set request_sent back to 0 and decrement num_requests before batadv_bla_send_request() incremented it. The two operations must therefore be locked. And since state (request_sent) and wait_periods are only accessed inside this lock, they can be converted to simpler datatypes. And to avoid that the bla.num_requests is touched by a parallel running context with a valid backbone_gw reference after batadv_bla_purge_backbone_gw() ran, a third state "stopped" is required to correctly signal that a backbone_gw is in the state of being cleaned up.
AI Analysis
Technical Summary
The vulnerability in the Linux kernel's batman-adv module arises from a race condition where the bla.num_requests counter is decremented multiple times due to non-atomic operations on the request_sent state and the counter itself. The problem stems from time-of-check-to-time-of-use (TOCTOU) issues and concurrent execution of code paths that modify these variables without proper synchronization. The fix involves locking the operations that modify request_sent and bla.num_requests atomically and introducing a third state 'stopped' to signal when a backbone gateway is being cleaned up, preventing parallel contexts from incorrectly modifying the counter.
Potential Impact
Improper synchronization can lead to inconsistent internal state in the batman-adv kernel module, potentially causing logic errors or instability in the mesh networking functionality. The exact impact is not detailed, and no known exploits are reported. The vulnerability could affect the reliability of the batman-adv protocol operations within the Linux kernel.
Mitigation Recommendations
A fix has been implemented in the Linux kernel to address this issue by adding proper locking and state management. Users should apply the official kernel updates that include this patch once available. Patch status is not explicitly confirmed in the provided data; therefore, check the vendor or Linux kernel advisories for the current remediation status and apply updates accordingly.
In the Linux kernel, the following vulnerability has been resolved: batman-adv: bla: avoid double decrement of bla.num_requests The bla.num_requests… (CVE-2026-64095)
Description
In the Linux kernel, the following vulnerability has been resolved: batman-adv: bla: avoid double decrement of bla.num_requests The bla.num_requests is increased when no request_sent was in progress. And it is decremented in various places (announcement was received, backbone is purged, periodic work). But the check if the request_sent is actually set to a specific state and the atomic_dec/_inc are not safe because they are not atomic (TOCTOU) and multiple such code portions can run concurrently. At the same time, it is necessary to modify request_sent (state) and bla.num_requests atomically. Otherwise batadv_bla_send_request() might set request_sent to 1 and is interrupted. batadv_handle_announce() can then set request_sent back to 0 and decrement num_requests before batadv_bla_send_request() incremented it. The two operations must therefore be locked. And since state (request_sent) and wait_periods are only accessed inside this lock, they can be converted to simpler datatypes. And to avoid that the bla.num_requests is touched by a parallel running context with a valid backbone_gw reference after batadv_bla_purge_backbone_gw() ran, a third state "stopped" is required to correctly signal that a backbone_gw is in the state of being cleaned up.
CVSS v3.1
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in the Linux kernel's batman-adv module arises from a race condition where the bla.num_requests counter is decremented multiple times due to non-atomic operations on the request_sent state and the counter itself. The problem stems from time-of-check-to-time-of-use (TOCTOU) issues and concurrent execution of code paths that modify these variables without proper synchronization. The fix involves locking the operations that modify request_sent and bla.num_requests atomically and introducing a third state 'stopped' to signal when a backbone gateway is being cleaned up, preventing parallel contexts from incorrectly modifying the counter.
Potential Impact
Improper synchronization can lead to inconsistent internal state in the batman-adv kernel module, potentially causing logic errors or instability in the mesh networking functionality. The exact impact is not detailed, and no known exploits are reported. The vulnerability could affect the reliability of the batman-adv protocol operations within the Linux kernel.
Mitigation Recommendations
A fix has been implemented in the Linux kernel to address this issue by adding proper locking and state management. Users should apply the official kernel updates that include this patch once available. Patch status is not explicitly confirmed in the provided data; therefore, check the vendor or Linux kernel advisories for the current remediation status and apply updates accordingly.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-q65p-8m3g-4fpv
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-64095"]
- Ecosystems
- []
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a5d27a82a4a8d598912b541
Added to database: 07/19/2026, 19:38:16 UTC
Last enriched: 07/19/2026, 19:47:23 UTC
Last updated: 07/20/2026, 19:41:21 UTC
Views: 13
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.