High 8.8Published Jul 19, 2026

CVE-2026-64096batman-adv: mcast: fix use-after-free in orig_node RCU release

Updated under an hour ago (Oct 26, 2026, 6:40 PM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: batman-adv: mcast: fix use-after-free in orig_node RCU release batadv_mcast_purge_orig() removes entries from RCU-protected hlists but does not wait for an RCU grace period before returning. Concurrent RCU readers may still accesses references to those entries at the point of removal. RCU-protected readers trying to operate on entries like orig->mcast_want_all_ipv6_node will then access already freed memory. Fix this by moving batadv_mcast_purge_orig() to batadv_orig_node_release(), just before the call_rcu() invocation. This ensures RCU readers that were active at purge time have drained before the orig_node memory is reclaimed.

CVSS: 8.8 HIGH (v3.1, CNA)CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Analyzed
Record last updated: Aug 5, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from ab49886e3da73b6b35ece21006e191910427bb30 before ff3a4487ead475e27b43280b8ee3d8464fe280e1; from ab49886e3da73b6b35ece21006e191910427bb30 before 78a63fb2f7d5630d1c1f2859a20d4e4226863b41; from ab49886e3da73b6b35ece21006e191910427bb30 before ced48f55bac73f0822eae90509e51b42b4f646c8; from ab49886e3da73b6b35ece21006e191910427bb30 before 70bcb678561f0fb58f33270fc73f12f3be72b878; from ab49886e3da73b6b35ece21006e191910427bb30 before aef897c9d2dd0d9339167fb82b62beff68d076cb; from ab49886e3da73b6b35ece21006e191910427bb30 before 8a3707653ab658e082ccd992e92594e01b09a3fc; from ab49886e3da73b6b35ece21006e191910427bb30 before edfb1e094104a50f931553dc82ac59246569fd32; from ab49886e3da73b6b35ece21006e191910427bb30 before 20c2d6a20ca936f5aaa6dd40f73f262ac45c87cc	CNA record
linux linux_kernel linux:linux_kernel	from 3.15 before 5.10.258; from 5.11 before 5.15.209; from 5.16 before 6.1.175; from 6.2 before 6.6.142; from 6.7 before 6.12.92; from 6.13 before 6.18.34; from 6.19 before 7.0.11; 7.1; and 3 more ranges	NVD

References

References

https://git.kernel.org/stable/c/ff3a4487ead475e27b43280b8ee3d8464fe280e1	patch
https://git.kernel.org/stable/c/78a63fb2f7d5630d1c1f2859a20d4e4226863b41	patch
https://git.kernel.org/stable/c/ced48f55bac73f0822eae90509e51b42b4f646c8	patch
https://git.kernel.org/stable/c/70bcb678561f0fb58f33270fc73f12f3be72b878	patch
https://git.kernel.org/stable/c/aef897c9d2dd0d9339167fb82b62beff68d076cb	patch
https://git.kernel.org/stable/c/8a3707653ab658e082ccd992e92594e01b09a3fc	patch
https://git.kernel.org/stable/c/edfb1e094104a50f931553dc82ac59246569fd32	patch
https://git.kernel.org/stable/c/20c2d6a20ca936f5aaa6dd40f73f262ac45c87cc	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.