The Linux kernel's batman-adv multicast subsystem contained a use-after-free vulnerability in the orig_node RCU release mechanism. Specifically, batadv_mcast_purge_orig() removed entries from RCU-protected hash lists but did not wait for an RCU grace period before returning, allowing concurrent RCU readers to access freed memory such as orig->mcast_want_all_ipv6_node. The fix moves batadv_mcast_purge_orig() to batadv_orig_node_release(), just before the call_rcu() invocation, ensuring that RCU readers active during purge have drained before memory reclamation. This vulnerability was assigned CVE-2026-64096 with a CVSS 3.1 score of 8.8 (high impact). Multiple linux-aws kernel versions prior to 5.15.0-1112.119~20.04.1 and others are affected. The vendor advisory from Ubuntu confirms the availability of patches and recommends updating and rebooting to apply fixes.

Exploitation of this use-after-free vulnerability could allow attackers to cause memory corruption in the kernel, potentially leading to system crashes or privilege escalation. The CVSS score of 8.8 indicates high impact on confidentiality, integrity, and availability. However, no known exploits in the wild have been reported. The vulnerability affects the stability and security of systems running affected linux-aws kernel versions.

A patch is available from the vendor. Users should update their linux-aws kernel packages to versions at or above 5.15.0-1112.119~20.04.1 (and other specified fixed versions) and reboot the system to apply the fix. Due to an ABI change, recompilation and reinstallation of third-party kernel modules may be required. Follow the vendor's update instructions carefully to ensure complete remediation.