CVE-2026-64091

Estado: AnalizadaCrítica (9.8)—

In the Linux kernel, the following vulnerability has been resolved:

batman-adv: tt: fix TOCTOU race for reported vlans

The local TT based TVLV is generated by first checking the number of VLANs which have at least one TT entry. A new buffer with the correct size for the VLANs is then allocated. Only then, the list of VLANs s used to fill the VLAN entries in the buffer. During this time, the meshif_vlan_list_lock is held. But the actual number of TT entries of each VLAN can still increase during this time - just not the number of VLANs in the list.

But the prefilter used in the buffer size calculation might still cause an increase of the number of VLANs which need to be stored.

Leer descripción completaMostrar menos

Simply because a VLAN might now suddenly have at least one entry when it had none in the pre-alloc check - and then needs to occupy space which was not allocated.

It is better to overestimate the buffer size at the beginning and then fill the buffer only with the VLANs which are not empty.

CVSS

Versión: 3.1
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Puntuación base: 9.8

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 0.43%
Percentil entre todas las CVEs puntuadas: 35
Fecha de la puntuación: 5/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

ExplotaciónT1190 Exploit Public-Facing Applicationinitial access45 %
Impacto secundarioT1565.001 Stored Data Manipulationimpact40 %

CWE-367 (TOCTOU) en kernel Linux remoto sin autenticación (AV:N PR:N UI:N), pero es DoS por race condition en gestión de memoria/buffers, no RCE típica. Confidencialidad e integridad altas sugieren corrupción de datos o información.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Vulnerability Scanning Restrict File and Directory Permissions Privileged Account Management Remote Data Storage Network Segmentation Limit Access to Resource Over Network

Tecnologías afectadas (1)

Linux — Linux Kernel

CWE

CWE-367

Referencias

JSON original (NVD)

Mostrar

{
  "id": "CVE-2026-64091",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "16116dac23396e73c01eeee97b102e4833a4b205",
              "lessThan": "e4236bf3ec8d6bb15d0d8d825dcf9933a7d6666b",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "16116dac23396e73c01eeee97b102e4833a4b205",
              "lessThan": "724a8eb4155669797c96b70d70e354284ae3b5a8",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "16116dac23396e73c01eeee97b102e4833a4b205",
              "lessThan": "211ea59988e1cba43cb0367ad65d379b56f9c3bd",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "16116dac23396e73c01eeee97b102e4833a4b205",
              "lessThan": "65a1e67339aa8c95ac544b796946af388930ee23",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "16116dac23396e73c01eeee97b102e4833a4b205",
              "lessThan": "b4d4efd4e351593c81e9293d4b4408d244fa5ee7",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "16116dac23396e73c01eeee97b102e4833a4b205",
              "lessThan": "4cc85aec8d3c9ab4dc716dc9f1ed36fca16b227f",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "16116dac23396e73c01eeee97b102e4833a4b205",
              "lessThan": "9a9c859457bc440a55773e01ff18b1bb5bab6836",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "16116dac23396e73c01eeee97b102e4833a4b205",
              "lessThan": "94d27005016be15ffc638b2ecbc4d58805ad7b48",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "3134c5a32810c510f1f447c135cec346acbb71c3",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "e861e03a1b5b615ad1b57b1802b17e260eedccfe",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "0b81edc8818903c64c4d121bc51cd5825be8cc67",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "90ae6475b1753f0c1a4c66034b5666de3189fac8",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "3.16.60",
              "lessThan": "3.17",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "4.4.217",
              "lessThan": "4.5",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "4.9.217",
              "lessThan": "4.10",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "4.14.174",
              "lessThan": "4.15",
              "versionType": "semver"
            }
          ],
          "programFiles": [
            "net/batman-adv/translation-table.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.17"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "4.17",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "5.10.259",
              "versionType": "semver",
              "lessThanOrEqual": "5.10.*"
            },
            {
              "status": "unaffected",
              "version": "5.15.210",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "status": "unaffected",
              "version": "6.1.176",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "status": "unaffected",
              "version": "6.6.143",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "status": "unaffected",
              "version": "6.12.93",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.18.34",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.0.11",
              "versionType": "semver",
              "lessThanOrEqual": "7.0.*"
            },
            {
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "net/batman-adv/translation-table.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-07-19T16:17:49.967",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/211ea59988e1cba43cb0367ad65d379b56f9c3bd",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/4cc85aec8d3c9ab4dc716dc9f1ed36fca16b227f",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/65a1e67339aa8c95ac544b796946af388930ee23",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/724a8eb4155669797c96b70d70e354284ae3b5a8",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/94d27005016be15ffc638b2ecbc4d58805ad7b48",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/9a9c859457bc440a55773e01ff18b1bb5bab6836",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/b4d4efd4e351593c81e9293d4b4408d244fa5ee7",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/e4236bf3ec8d6bb15d0d8d825dcf9933a7d6666b",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-367"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbatman-adv: tt: fix TOCTOU race for reported vlans\n\nThe local TT based TVLV is generated by first checking the number of VLANs\nwhich have at least one TT entry. A new buffer with the correct size for\nthe VLANs is then allocated. Only then, the list of VLANs s used to fill\nthe VLAN entries in the buffer. During this time, the meshif_vlan_list_lock\nis held. But the actual number of TT entries of each VLAN can still\nincrease during this time - just not the number of VLANs in the list.\n\nBut the prefilter used in the buffer size calculation might still cause an\nincrease of the number of VLANs which need to be stored. Simply because a\nVLAN might now suddenly have at least one entry when it had none in the\npre-alloc check - and then needs to occupy space which was not allocated.\n\nIt is better to overestimate the buffer size at the beginning and then fill\nthe buffer only with the VLANs which are not empty."
    }
  ],
  "lastModified": "2026-08-11T15:36:30.617",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "00B213F5-FFE1-4935-A397-495350473D00",
              "versionEndExcluding": "3.17",
              "versionStartIncluding": "3.16.60"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3E1D0738-1B7B-46CA-8991-C6C68E7CD03A",
              "versionEndExcluding": "4.5",
              "versionStartIncluding": "4.4.217"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D60CCC1F-6435-409A-8DD9-B2E6A8071EF6",
              "versionEndExcluding": "4.10",
              "versionStartIncluding": "4.9.217"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C753FF3A-CAD5-4C49-BA73-A0D9B42E7735",
              "versionEndExcluding": "4.15",
              "versionStartIncluding": "4.14.174"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F95E5586-82AE-4482-A145-E8DE28296292",
              "versionEndExcluding": "5.10.259",
              "versionStartIncluding": "4.17.1"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5E938CDF-D1C4-43D0-98DC-9E11B6B55801",
              "versionEndExcluding": "5.15.210",
              "versionStartIncluding": "5.11"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C4446623-5F2B-4DD8-8666-9FAAC285A757",
              "versionEndExcluding": "6.1.176",
              "versionStartIncluding": "5.16"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9062F1CD-CAD6-4EA2-A73F-C06D4A887B8C",
              "versionEndExcluding": "6.6.143",
              "versionStartIncluding": "6.2"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1E73413E-0629-41AA-A4D3-5A3D10A0BD63",
              "versionEndExcluding": "6.12.93",
              "versionStartIncluding": "6.7"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A4B1EF6D-18D7-4838-BC37-7499D5DCC3C0",
              "versionEndExcluding": "6.18.34",
              "versionStartIncluding": "6.13"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0520D091-FC52-4A50-AF07-70AE7D08B750",
              "versionEndExcluding": "7.0.11",
              "versionStartIncluding": "6.19"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:4.17:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3F438846-FE97-43DC-A655-B5EF8DED552E"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:4.17:rc7:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A665D441-505B-4569-9EBD-96EFC9DA73BC"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B1EF7059-E670-45F4-B422-54C40FA86390"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0D38F0BF-A728-4133-A358-D44A2F7EE6D6"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EC732D08-5F7B-46D9-B154-E60C7F4F0A97"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E5910A9D-F60A-409A-B486-FE66BFEBA9B9"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}