CVE-2026-64095

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

batman-adv: bla: avoid double decrement of bla.num_requests

The bla.num_requests is increased when no request_sent was in progress. And

it is decremented in various places (announcement was received, backbone is

purged, periodic work). But the check if the request_sent is actually set

to a specific state and the atomic_dec/_inc are not safe because they are

not atomic (TOCTOU) and multiple such code portions can run concurrently.

At the same time, it is necessary to modify request_sent (state) and

bla.num_requests atomically. Otherwise batadv_bla_send_request() might set

request_sent to 1 and is interrupted. batadv_handle_announce() can then

set request_sent back to 0 and decrement num_requests before

batadv_bla_send_request() incremented it.

The two operations must therefore be locked. And since state (request_sent)

and wait_periods are only accessed inside this lock, they can be converted

to simpler datatypes. A

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References