High 8.8Published Jul 19, 2026

CVE-2026-64093batman-adv: tp_meter: directly shut down timer on cleanup

Updated under an hour ago (Oct 26, 2026, 9:00 PM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: batman-adv: tp_meter: directly shut down timer on cleanup batadv_tp_sender_cleanup() was calling timer_delete_sync() followed by timer_delete() to guard against the timer handler re-arming itself between the two calls. This double-deletion hack relied on the sending status being set to 0 to suppress re-arming. Replace both calls with a single timer_shutdown_sync(). This function both waits for any running timer callback to complete (like timer_delete_sync()) and permanently disarms the timer so it cannot be re-armed afterwards, making re-arming prevention unconditional and self-documenting. The re-arming property is also required because otherwise: 1. context 0 (batadv_tp_recv_ack()) checks in batadv_tp_reset_sender_timer() if sending is still 1 -> it is 2. context 1 changes in batadv_tp_sender_shutdown() sending to 0 and in this process forces the kthread to stop timer in batadv_tp_sender_cleanup() 3. context 0 continues in batadv_tp_reset_sender_timer() and rearms the timer -> but the reference for it is already gone

CVSS: 8.8 HIGH (v3.1, CNA)CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Analyzed
Record last updated: Aug 5, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	33a3bb4a3345bb511f9c69c913da95d4693e2a4e builds before 00bf4bb9947b1190a8be8d9b6a1bcbfa3707785c; from 33a3bb4a3345bb511f9c69c913da95d4693e2a4e before 74a76634055462833446684fd526d73c290ea43a; 33a3bb4a3345bb511f9c69c913da95d4693e2a4e builds before 5bc2d50fb66b46f86543d5153a188eb1486d0b6e; from 33a3bb4a3345bb511f9c69c913da95d4693e2a4e before f86b20ec8d17d77bddc02c5c86cfa2389d84ecff; from 33a3bb4a3345bb511f9c69c913da95d4693e2a4e before 770bf0a35f0620b526fd4193889d1e77084e4c43; from 33a3bb4a3345bb511f9c69c913da95d4693e2a4e before 933880a8bc9b4042223a79255c0b1021cdc36991; from 33a3bb4a3345bb511f9c69c913da95d4693e2a4e before d5487249a81ea658717614009c8f46acc5b7101a	CNA record
linux linux_kernel linux:linux_kernel	from 4.8 before 5.15.210; from 5.16 before 6.1.176; from 6.2 before 6.6.143; from 6.7 before 6.12.93; from 6.13 before 6.18.34; from 6.19 before 7.0.11; 7.1; 7.1; and 2 more ranges	NVD

References

References

https://git.kernel.org/stable/c/00bf4bb9947b1190a8be8d9b6a1bcbfa3707785c	patch
https://git.kernel.org/stable/c/74a76634055462833446684fd526d73c290ea43a	patch
https://git.kernel.org/stable/c/5bc2d50fb66b46f86543d5153a188eb1486d0b6e	patch
https://git.kernel.org/stable/c/f86b20ec8d17d77bddc02c5c86cfa2389d84ecff	patch
https://git.kernel.org/stable/c/770bf0a35f0620b526fd4193889d1e77084e4c43	patch
https://git.kernel.org/stable/c/933880a8bc9b4042223a79255c0b1021cdc36991	patch
https://git.kernel.org/stable/c/d5487249a81ea658717614009c8f46acc5b7101a	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.