CVE-2026-64094
Estado: AnalizadaMedia (5.5)—
In the Linux kernel, the following vulnerability has been resolved:
batman-adv: bla: avoid NULL-ptr deref for claim via dropped interface
Without rtnl_lock held, a hardif might be retrieved as primary interface of a meshif, but then (while operating on this interface) getting decoupled from the mesh interface. In this case, the meshif still exists but the pointer from the primary hardif to the meshif is set to NULL.
The mesh_iface must be checked first to be non-NULL before continuing to send an ARP request using meshif.
CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- Puntuación base: 5.5
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 0.16%
- Percentil entre todas las CVEs puntuadas: 5
- Fecha de la puntuación: 5/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (1)
CWE
- CWE-476
Referencias
- https://git.kernel.org/stable/c/0f3ebd7bb417aabc44853cc7c2a184ebb0e05b45
- https://git.kernel.org/stable/c/2a8c9e86529156c62d9187b9ed9454c31665ad33
- https://git.kernel.org/stable/c/4f6266735a0ba6a568b6d4c9fa51c33a5a7f2d70
- https://git.kernel.org/stable/c/53cb3511f6eda37d3bd923545fdba6013b6d7bb7
- https://git.kernel.org/stable/c/555b8d3f5c313d81d46274fd0976352dafc80124
- https://git.kernel.org/stable/c/6921a7683ae9ad0208d829e71f725a9e25ccff49
- https://git.kernel.org/stable/c/efb62458c94db1fe3a287e7e89c31b0cfb03f938
- https://git.kernel.org/stable/c/f80d3d98d2ff78d9e2fe5d68b1f45948c4f7bd24
JSON original (NVD)
Mostrar
{
"id": "CVE-2026-64094",
"cveTags": [],
"metrics": {
"cvssMetricV31": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 5.5,
"attackVector": "LOCAL",
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"integrityImpact": "NONE",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "LOW",
"confidentialityImpact": "NONE"
},
"impactScore": 3.6,
"exploitabilityScore": 1.8
}
]
},
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "23721387c409087fd3b97e274f34d3ddc0970b74",
"lessThan": "4f6266735a0ba6a568b6d4c9fa51c33a5a7f2d70",
"versionType": "git"
},
{
"status": "affected",
"version": "23721387c409087fd3b97e274f34d3ddc0970b74",
"lessThan": "53cb3511f6eda37d3bd923545fdba6013b6d7bb7",
"versionType": "git"
},
{
"status": "affected",
"version": "23721387c409087fd3b97e274f34d3ddc0970b74",
"lessThan": "efb62458c94db1fe3a287e7e89c31b0cfb03f938",
"versionType": "git"
},
{
"status": "affected",
"version": "23721387c409087fd3b97e274f34d3ddc0970b74",
"lessThan": "2a8c9e86529156c62d9187b9ed9454c31665ad33",
"versionType": "git"
},
{
"status": "affected",
"version": "23721387c409087fd3b97e274f34d3ddc0970b74",
"lessThan": "0f3ebd7bb417aabc44853cc7c2a184ebb0e05b45",
"versionType": "git"
},
{
"status": "affected",
"version": "23721387c409087fd3b97e274f34d3ddc0970b74",
"lessThan": "6921a7683ae9ad0208d829e71f725a9e25ccff49",
"versionType": "git"
},
{
"status": "affected",
"version": "23721387c409087fd3b97e274f34d3ddc0970b74",
"lessThan": "555b8d3f5c313d81d46274fd0976352dafc80124",
"versionType": "git"
},
{
"status": "affected",
"version": "23721387c409087fd3b97e274f34d3ddc0970b74",
"lessThan": "f80d3d98d2ff78d9e2fe5d68b1f45948c4f7bd24",
"versionType": "git"
}
],
"programFiles": [
"net/batman-adv/bridge_loop_avoidance.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "3.5"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "3.5",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.10.259",
"versionType": "semver",
"lessThanOrEqual": "5.10.*"
},
{
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver",
"lessThanOrEqual": "5.15.*"
},
{
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.93",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.34",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.0.11",
"versionType": "semver",
"lessThanOrEqual": "7.0.*"
},
{
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"net/batman-adv/bridge_loop_avoidance.c"
],
"defaultStatus": "affected"
}
]
}
],
"published": "2026-07-19T16:17:50.353",
"references": [
{
"url": "https://git.kernel.org/stable/c/0f3ebd7bb417aabc44853cc7c2a184ebb0e05b45",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/2a8c9e86529156c62d9187b9ed9454c31665ad33",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/4f6266735a0ba6a568b6d4c9fa51c33a5a7f2d70",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/53cb3511f6eda37d3bd923545fdba6013b6d7bb7",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/555b8d3f5c313d81d46274fd0976352dafc80124",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/6921a7683ae9ad0208d829e71f725a9e25ccff49",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/efb62458c94db1fe3a287e7e89c31b0cfb03f938",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/f80d3d98d2ff78d9e2fe5d68b1f45948c4f7bd24",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"vulnStatus": "Analyzed",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-476"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbatman-adv: bla: avoid NULL-ptr deref for claim via dropped interface\n\nWithout rtnl_lock held, a hardif might be retrieved as primary interface of\na meshif, but then (while operating on this interface) getting decoupled\nfrom the mesh interface. In this case, the meshif still exists but the\npointer from the primary hardif to the meshif is set to NULL.\n\nThe mesh_iface must be checked first to be non-NULL before continuing to\nsend an ARP request using meshif."
}
],
"lastModified": "2026-08-11T16:11:41.570",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9E886974-D8A8-4620-9268-5FE88C4AFDEF",
"versionEndExcluding": "5.10.259",
"versionStartIncluding": "3.5"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5E938CDF-D1C4-43D0-98DC-9E11B6B55801",
"versionEndExcluding": "5.15.210",
"versionStartIncluding": "5.11"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C4446623-5F2B-4DD8-8666-9FAAC285A757",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "5.16"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9062F1CD-CAD6-4EA2-A73F-C06D4A887B8C",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "6.2"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1E73413E-0629-41AA-A4D3-5A3D10A0BD63",
"versionEndExcluding": "6.12.93",
"versionStartIncluding": "6.7"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A4B1EF6D-18D7-4838-BC37-7499D5DCC3C0",
"versionEndExcluding": "6.18.34",
"versionStartIncluding": "6.13"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0520D091-FC52-4A50-AF07-70AE7D08B750",
"versionEndExcluding": "7.0.11",
"versionStartIncluding": "6.19"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B1EF7059-E670-45F4-B422-54C40FA86390"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0D38F0BF-A728-4133-A358-D44A2F7EE6D6"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "EC732D08-5F7B-46D9-B154-E60C7F4F0A97"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E5910A9D-F60A-409A-B486-FE66BFEBA9B9"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}