Use-after-free in Linux kernel - CVE-2026-64218

Vulnerability identifier: #VU139785

CSH Severity: Low

CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-64218

CWE-ID: CWE-416

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in batadv_bla_purge_backbone_gw() in the bridge loop avoidance component when purging stale backbone gateway entries. A local user can trigger report_work to access freed memory to cause a denial of service.

The issue occurs when associated report_work is still running or pending during backbone gateway cleanup.

Linux kernel
Ubuntu
linux-intel-iot-realtime (Ubuntu package)
linux-intel-iotg (Ubuntu package)
linux-azure-5.15 (Ubuntu package)
linux-gcp-5.15 (Ubuntu package)
linux-azure-fips (Ubuntu package)
linux (Ubuntu package)
linux-aws (Ubuntu package)
linux-gcp-7.0 (Ubuntu package)
linux-nvidia (Ubuntu package)
linux-nvidia-bos (Ubuntu package)

Install security update from vendor's repository.

Linux kernel - update to 7.0 rc3
linux-intel-iot-realtime (Ubuntu package) - addressed in versions 5.15.0-1104.106, 5.15.0.1104.108, 5.15.0-1107.113~20.04.1
linux-intel-iotg (Ubuntu package) - addressed in versions 5.15.0.1107.106, 5.15.0-1107.113
linux-azure-5.15 (Ubuntu package) - addressed in versions 5.15.0-1109.115~20.04.1, 5.15.0-1117.126~20.04.1, 5.15.0-1117.126~20.04.2
linux-gcp-5.15 (Ubuntu package) - update to 5.15.0-1112.122~20.04.1
linux-azure-fips (Ubuntu package) - addressed in versions 5.15.0.1117.102, 5.15.0-1117.126+fips1
linux (Ubuntu package) - addressed in versions 6.8.0-139.139+fips1, 6.8.0-1049.53, 6.8.0-1062.65+fips1, 6.8.0-1062.65.1, 6.8.0-1062.65~22.04.1, 6.8.0-1062.70, 6.8.0-1064.68, 6.8.0-1067.75, 6.8.0-1067.75+fips1, 6.8.1-1059.60, 6.8.1-1059.60~22.04.1
linux-aws (Ubuntu package) - addressed in versions 7.0.0-1009.9, 7.0.0-1015.15
linux-gcp-7.0 (Ubuntu package) - update to 7.0.0-1011.11~24.04.1
linux-nvidia (Ubuntu package) - addressed in versions 7.0.0-1016.16, 7.0.0-1016.16~24.04.1
linux-nvidia-bos (Ubuntu package) - update to 7.0.0-2016.16

• https://git.kernel.org/stable/c/0459430add32ea41f3e2ef9351610e6d33627a6b
• https://git.kernel.org/stable/c/3423a45e5c3d3c5129f88143a9a969787d7d5a0a
• https://git.kernel.org/stable/c/48663158222b3b7f6ee6791a67d512ede7fc94bb
• https://git.kernel.org/stable/c/95a7034661274cf5985708bd2f6d86ee46f88fa9
• https://git.kernel.org/stable/c/c6de1a5a9c406e30b91f1515a6ce05cc84023baa
• https://git.kernel.org/stable/c/ce2c0ee4d76d5ee4b391fe0e31334361e25030ec
• https://git.kernel.org/stable/c/eeddd7bab3d59c1e98642a204141f8c5d6194707
• https://git.kernel.org/stable/c/f1303adb1e59582f76c22798a2e2e150e054a9e7

• Use-after-free in Linux kernel batman-adv
• Ubuntu update for linux-azure-5.15
• Ubuntu update for linux-aws
• Ubuntu update for linux-azure-fips
• Ubuntu update for linux-intel-iot-realtime
• Ubuntu update for linux-intel-iotg
• Ubuntu update for linux-nvidia-bos
• Ubuntu update for linux-nvidia
• Ubuntu update for linux-gcp-5.15
• Ubuntu update for linux
• Ubuntu update for linux-gcp-7.0