Linux aws: In the Linux kernel, the following vulnerability has been resolved: batman-adv: mcast: fix use-after-free in orig_node RCU release… (CVE-2026-64096)

CVE-2026-64096 addresses a use-after-free vulnerability in the Linux kernel's batman-adv multicast subsystem. The function batadv_mcast_purge_orig() removed entries from RCU-protected hash lists without waiting for an RCU grace period, allowing concurrent RCU readers to access freed memory such as orig->mcast_want_all_ipv6_node. The fix moves the purge call to batadv_orig_node_release() before call_rcu(), ensuring readers have drained before memory reclamation. This vulnerability affects linux-aws kernel versions prior to 5.15.0-1112.119~20.04.1, 5.15.0-1117.126~20.04.1, 5.15.0-1117.126~20.04.2, 5.15.0-1112.122~20.04.1, and 5.15.0-186.196~20.04.1. The issue was patched as part of Ubuntu security notices USN-8575-1 and USN-8576-1, which also addressed numerous other kernel vulnerabilities. The CVSS 3.1 score is 8.8 (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

The vulnerability allows concurrent RCU readers to access memory that has been freed, potentially leading to memory corruption, system crashes, or privilege escalation. The CVSS score indicates high impact on confidentiality, integrity, and availability. However, no known exploits in the wild have been reported. Systems running affected linux-aws kernel versions are at risk until patched.

A patch is available and included in official Ubuntu security updates (USN-8575-1, USN-8576-1). Users should update their linux-aws kernel packages to versions at or above 5.15.0-1112.119~20.04.1 (and other fixed versions) and reboot the system to apply the fix. Due to an ABI change, third-party kernel modules must be recompiled and reinstalled after the update. No additional mitigation is required beyond applying the official patch.