{"cve":"CVE-2026-64218","nvd":{"published":"2026-07-24T16:16:49.520","modified":"2026-08-11T18:26:37.047","status":"Analyzed","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nbatman-adv: bla: fix report_work leak on backbone_gw purge\n\nbatadv_bla_purge_backbone_gw() removes stale backbone gateway entries,\nbut fails to properly handle their associated report_work:\n\n- If report_work is running, the purge must wait for it to finish before\n  freeing the backbone_gw, otherwise the worker may access freed memory\n  (e.g. bat_priv).\n- If report_work is pending, the purge must cancel it and release the\n  reference held for that pending work item.\n\nThe previous implementation called hlist_for_each_entry_safe() inside a\nspin_lock_bh() section, but cancel_work_sync() may sleep and therefore\ncannot be called from within a spinlock-protected region.\n\nRestructure the loop to handle one entry per spinlock critical section:\nacquire the lock, find the next entry to purge, remove it from the hash\nlist, then release the lock before calling cancel_work_sync() and\ndropping the hash_entry reference. Repeat until no more entries require\npurging.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8},"cwes":[],"references":["https://git.kernel.org/stable/c/0459430add32ea41f3e2ef9351610e6d33627a6b","https://git.kernel.org/stable/c/3423a45e5c3d3c5129f88143a9a969787d7d5a0a","https://git.kernel.org/stable/c/48663158222b3b7f6ee6791a67d512ede7fc94bb","https://git.kernel.org/stable/c/95a7034661274cf5985708bd2f6d86ee46f88fa9","https://git.kernel.org/stable/c/c6de1a5a9c406e30b91f1515a6ce05cc84023baa"],"products":["linux:linux_kernel"],"source":"nvd","synced_at":"2026-10-19T22:46:40.600842820+00:00"},"epss":{"cve":"CVE-2026-64218","score":0.0013,"percentile":0.02577,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}