Time-of-check Time-of-use (TOCTOU) Race Condition in Linux kernel - CVE-2026-64091
Published: July 20, 2026
Vulnerability identifier: #VU138554
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2026-64091
CWE-ID: CWE-367
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vendor: Linux Foundation
Affected software:
Linux kernel
Linux kernel
Detailed vulnerability description
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a race condition leading to an out-of-bounds write in batadv_tt_prepare_tvlv_local_data in the batman-adv translation table handling when generating local TT TVLV data for reported VLANs. A local user can trigger concurrent VLAN translation table entry changes to cause a denial of service.
The issue arises from a time-of-check time-of-use condition where the number of non-empty VLANs can increase after buffer sizing but before the buffer is filled.
How to mitigate CVE-2026-64091
Install security update from vendor's repository.
Sources
- https://git.kernel.org/stable/c/211ea59988e1cba43cb0367ad65d379b56f9c3bd
- https://git.kernel.org/stable/c/4cc85aec8d3c9ab4dc716dc9f1ed36fca16b227f
- https://git.kernel.org/stable/c/65a1e67339aa8c95ac544b796946af388930ee23
- https://git.kernel.org/stable/c/724a8eb4155669797c96b70d70e354284ae3b5a8
- https://git.kernel.org/stable/c/94d27005016be15ffc638b2ecbc4d58805ad7b48
- https://git.kernel.org/stable/c/9a9c859457bc440a55773e01ff18b1bb5bab6836
- https://git.kernel.org/stable/c/b4d4efd4e351593c81e9293d4b4408d244fa5ee7
- https://git.kernel.org/stable/c/e4236bf3ec8d6bb15d0d8d825dcf9933a7d6666b