In the Linux kernel, the following vulnerability has been resolved: batman-adv: tt: fix TOCTOU race for reported vlans The local TT based TVLV is… (CVE-2026-64091)
In the Linux kernel, the following vulnerability has been resolved: batman-adv: tt: fix TOCTOU race for reported vlans The local TT based TVLV is generated by first checking the number of VLANs which have at least one TT entry. A new buffer with the correct size for the VLANs is then allocated. Only then, the list of VLANs s used to fill the VLAN entries in the buffer. During this time, the meshif_vlan_list_lock is held. But the actual number of TT entries of each VLAN can still increase during this time - just not the number of VLANs in the list. But the prefilter used in the buffer size calculation might still cause an increase of the number of VLANs which need to be stored. Simply because a VLAN might now suddenly have at least one entry when it had none in the pre-alloc check - and then needs to occupy space which was not allocated. It is better to overestimate the buffer size at the beginning and then fill the buffer only with the VLANs which are not empty.
AI Analysis
Technical Summary
The vulnerability in the Linux kernel's batman-adv module concerns a TOCTOU race condition in the handling of VLAN entries for the TT based TVLV. Initially, the number of VLANs with at least one TT entry is checked and a buffer is allocated accordingly while holding a lock on the VLAN list. However, the actual number of TT entries per VLAN can increase after this check, causing the pre-allocated buffer to be insufficient. This discrepancy arises because a VLAN might have no entries during the pre-allocation check but gain entries before filling the buffer, leading to potential buffer overflows or data inconsistencies. The resolution involves overestimating the buffer size at the start and then populating it only with VLANs that are confirmed to be non-empty, eliminating the race condition.
Potential Impact
The vulnerability could lead to incorrect handling of VLAN data within the batman-adv mesh networking component of the Linux kernel. While the exact impact is not detailed, such a race condition could cause memory corruption or data inconsistency in VLAN reporting, potentially affecting network stability or security. No known exploits in the wild have been reported.
Mitigation Recommendations
A fix has been implemented in the Linux kernel to address this TOCTOU race condition by changing the buffer allocation strategy. Users should apply the official Linux kernel updates that include this fix once available. Patch status is not explicitly confirmed in the provided data; therefore, users should consult the official Linux kernel advisories or repositories for the current remediation status.
In the Linux kernel, the following vulnerability has been resolved: batman-adv: tt: fix TOCTOU race for reported vlans The local TT based TVLV is… (CVE-2026-64091)
Description
In the Linux kernel, the following vulnerability has been resolved: batman-adv: tt: fix TOCTOU race for reported vlans The local TT based TVLV is generated by first checking the number of VLANs which have at least one TT entry. A new buffer with the correct size for the VLANs is then allocated. Only then, the list of VLANs s used to fill the VLAN entries in the buffer. During this time, the meshif_vlan_list_lock is held. But the actual number of TT entries of each VLAN can still increase during this time - just not the number of VLANs in the list. But the prefilter used in the buffer size calculation might still cause an increase of the number of VLANs which need to be stored. Simply because a VLAN might now suddenly have at least one entry when it had none in the pre-alloc check - and then needs to occupy space which was not allocated. It is better to overestimate the buffer size at the beginning and then fill the buffer only with the VLANs which are not empty.
CVSS v3.1
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in the Linux kernel's batman-adv module concerns a TOCTOU race condition in the handling of VLAN entries for the TT based TVLV. Initially, the number of VLANs with at least one TT entry is checked and a buffer is allocated accordingly while holding a lock on the VLAN list. However, the actual number of TT entries per VLAN can increase after this check, causing the pre-allocated buffer to be insufficient. This discrepancy arises because a VLAN might have no entries during the pre-allocation check but gain entries before filling the buffer, leading to potential buffer overflows or data inconsistencies. The resolution involves overestimating the buffer size at the start and then populating it only with VLANs that are confirmed to be non-empty, eliminating the race condition.
Potential Impact
The vulnerability could lead to incorrect handling of VLAN data within the batman-adv mesh networking component of the Linux kernel. While the exact impact is not detailed, such a race condition could cause memory corruption or data inconsistency in VLAN reporting, potentially affecting network stability or security. No known exploits in the wild have been reported.
Mitigation Recommendations
A fix has been implemented in the Linux kernel to address this TOCTOU race condition by changing the buffer allocation strategy. Users should apply the official Linux kernel updates that include this fix once available. Patch status is not explicitly confirmed in the provided data; therefore, users should consult the official Linux kernel advisories or repositories for the current remediation status.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-r4m5-xwcp-9p7w
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-64091"]
- Ecosystems
- []
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a5d27a92a4a8d598912befb
Added to database: 07/19/2026, 19:38:17 UTC
Last enriched: 07/19/2026, 19:51:03 UTC
Last updated: 07/20/2026, 19:41:21 UTC
Views: 11
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.