Improper resource shutdown or release in Linux kernel - CVE-2026-64092
Published: July 20, 2026
Vulnerability identifier: #VU138539
CSH Severity: Low
CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-64092
CWE-ID: CWE-404
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper resource shutdown handling in the batman-adv tp_meter receiver shutdown logic when stopping receiver sessions and handling timer expiration. A local user can trigger the affected code path to cause a denial of service.
The issue arises from a reference leak involving tp_vars during coordination between batadv_tp_receiver_shutdown() and batadv_tp_stop_all().
Affected software
Linux kernel
How to mitigate CVE-2026-64092
Install security update from vendor's repository.
Linux kernel - update to 7.0 rc3
External References
- https://git.kernel.org/stable/c/0b1bedf114ea93fef929b31f0d70a9eedcc601de
- https://git.kernel.org/stable/c/297e1bc4a915b7cd3e65a79ed906b23fb3d7aaae
- https://git.kernel.org/stable/c/77098e4bea37af51d3962efa88a5af2ea5e1ac57
- https://git.kernel.org/stable/c/7715c73f33260af724d734c41b794457e9be8dbc
- https://git.kernel.org/stable/c/a9f0bfd624ee8a286d6fd2bf0f796e730efb49b0
- https://git.kernel.org/stable/c/b285bc0a97f43823a4967fb6d286de4c7f53d541
- https://git.kernel.org/stable/c/d078501dde9b57210f1808cdef4b59463d1f5fc8