{"cve":"CVE-2026-63835","nvd":{"published":"2026-07-19T12:16:56.970","modified":"2026-08-17T05:17:21.483","status":"Awaiting Analysis","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nbatman-adv: v: prevent OGM aggregation on disabled hardif\n\nWhen an interface gets disabled, the worker is correctly disabled by\nbatadv_hardif_disable_interface() -> ... -> batadv_v_ogm_iface_disable().\nIn this process, the skb aggr_list is also freed.\n\nBut batadv_v_ogm_send_meshif() can still queue new skbs (via\nbatadv_v_ogm_queue_on_if()) to the aggr_list. This will only stop after all\ncores can no longer find the RCU protected list of hard interfaces. These\nqueued skbs will never be freed or consumed by batadv_v_ogm_aggr_work.\n\nThe batadv_v_ogm_iface_disable() function must block\nbatadv_v_ogm_queue_on_if() to avoid leak of skbs.","cvss_v4":null,"cvss_v3":null,"cwes":[],"references":["https://git.kernel.org/stable/c/3d4548c96d6f21ac1a9b06c5f82f3ef439c87023","https://git.kernel.org/stable/c/86ab6b6fb5b82163bf6c45780bb72150021d7349","https://git.kernel.org/stable/c/97644fdaaf6446ffbe182c5eb804fceb5b1a51b7","https://git.kernel.org/stable/c/d11c00b95b2a3b3934007fc003dccc6fdcc061ad","https://git.kernel.org/stable/c/d3569327fc7395b2b0461a0a0cb77a0bb74786c0"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:45:36.895656543+00:00"},"epss":{"cve":"CVE-2026-63835","score":0.00174,"percentile":0.06883,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}