CVE-2026-64093

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

batman-adv: tp_meter: directly shut down timer on cleanup

batadv_tp_sender_cleanup() was calling timer_delete_sync() followed by

timer_delete() to guard against the timer handler re-arming itself between

the two calls. This double-deletion hack relied on the sending status being

set to 0 to suppress re-arming.

Replace both calls with a single timer_shutdown_sync(). This function both

waits for any running timer callback to complete (like timer_delete_sync())

and permanently disarms the timer so it cannot be re-armed afterwards,

making re-arming prevention unconditional and self-documenting.

The re-arming property is also required because otherwise:

1. context 0 (batadv_tp_recv_ack()) checks in

batadv_tp_reset_sender_timer() if sending is still 1 -> it is

2. context 1 changes in batadv_tp_sender_shutdown() sending to 0 and in

this process forces the kthread to stop timer in

batadv_tp_sender_cleanup()

3. co

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References