batman-adv: bla: fix report_work leak on backbone_gw purge

MITRE NVD CVE.ORG JSON API

Summary

CVECVE-2026-64218
StatePUBLISHED
AssignerLinux
Source PriorityCVE Program / NVD first with legacy fallback
Published2026-07-24 16:16:49 UTC
Updated2026-08-11 18:26:37 UTC
DescriptionIn the Linux kernel, the following vulnerability has been resolved: batman-adv: bla: fix report_work leak on backbone_gw purge batadv_bla_purge_backbone_gw() removes stale backbone gateway entries, but fails to properly handle their associated report_work: - If report_work is running, the purge must wait for it to finish before freeing the backbone_gw, otherwise the worker may access freed memory (e.g. bat_priv). - If report_work is pending, the purge must cancel it and release the reference held for that pending work item. The previous implementation called hlist_for_each_entry_safe() inside a spin_lock_bh() section, but cancel_work_sync() may sleep and therefore cannot be called from within a spinlock-protected region. Restructure the loop to handle one entry per spinlock critical section: acquire the lock, find the next entry to purge, remove it from the hash list, then release the lock before calling cancel_work_sync() and dropping the hash_entry reference. Repeat until no more entries require purging.

Risk And Classification

Primary CVSS: v3.1 7.8 HIGH from 416baaa9-dc9f-4396-8d5f-8c081fb06d67

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.001290000 probability, percentile 0.029860000 (date 2026-08-03)

Problem Types: NVD-CWE-noinfo

VersionSourceTypeScoreSeverityVector
3.1416baaa9-dc9f-4396-8d5f-8c081fb06d67Secondary7.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
3.1CNADECLARED7.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v3.1 Breakdown

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

NVD Known Affected Configurations (CPE 2.3)

TypeVendorProductVersionUpdateEditionLanguage
Operating System Linux Linux Kernel All All All All

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA Linux Linux affected 23721387c409087fd3b97e274f34d3ddc0970b74 ce2c0ee4d76d5ee4b391fe0e31334361e25030ec git Not specified
CNA Linux Linux affected 23721387c409087fd3b97e274f34d3ddc0970b74 3423a45e5c3d3c5129f88143a9a969787d7d5a0a git Not specified
CNA Linux Linux affected 23721387c409087fd3b97e274f34d3ddc0970b74 f1303adb1e59582f76c22798a2e2e150e054a9e7 git Not specified
CNA Linux Linux affected 23721387c409087fd3b97e274f34d3ddc0970b74 48663158222b3b7f6ee6791a67d512ede7fc94bb git Not specified
CNA Linux Linux affected 23721387c409087fd3b97e274f34d3ddc0970b74 eeddd7bab3d59c1e98642a204141f8c5d6194707 git Not specified
CNA Linux Linux affected 23721387c409087fd3b97e274f34d3ddc0970b74 c6de1a5a9c406e30b91f1515a6ce05cc84023baa git Not specified
CNA Linux Linux affected 23721387c409087fd3b97e274f34d3ddc0970b74 95a7034661274cf5985708bd2f6d86ee46f88fa9 git Not specified
CNA Linux Linux affected 23721387c409087fd3b97e274f34d3ddc0970b74 0459430add32ea41f3e2ef9351610e6d33627a6b git Not specified
CNA Linux Linux affected 3.5 Not specified
CNA Linux Linux unaffected 3.5 semver Not specified
CNA Linux Linux unaffected 5.10.258 5.10.* semver Not specified
CNA Linux Linux unaffected 5.15.209 5.15.* semver Not specified
CNA Linux Linux unaffected 6.1.175 6.1.* semver Not specified
CNA Linux Linux unaffected 6.6.142 6.6.* semver Not specified
CNA Linux Linux unaffected 6.12.92 6.12.* semver Not specified
CNA Linux Linux unaffected 6.18.34 6.18.* semver Not specified
CNA Linux Linux unaffected 7.0.11 7.0.* semver Not specified
CNA Linux Linux unaffected 7.1 * original_commit_for_fix Not specified

References

ReferenceSourceLinkTags
git.kernel.org/stable/c/c6de1a5a9c406e30b91f1515a6ce05cc84023baa 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org Patch
git.kernel.org/stable/c/f1303adb1e59582f76c22798a2e2e150e054a9e7 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org Patch
git.kernel.org/stable/c/eeddd7bab3d59c1e98642a204141f8c5d6194707 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org Patch
git.kernel.org/stable/c/0459430add32ea41f3e2ef9351610e6d33627a6b 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org Patch
git.kernel.org/stable/c/ce2c0ee4d76d5ee4b391fe0e31334361e25030ec 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org Patch
git.kernel.org/stable/c/95a7034661274cf5985708bd2f6d86ee46f88fa9 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org Patch
git.kernel.org/stable/c/48663158222b3b7f6ee6791a67d512ede7fc94bb 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org Patch
git.kernel.org/stable/c/3423a45e5c3d3c5129f88143a9a969787d7d5a0a 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org Patch
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report