External risk intelligence

Linux Kernel batman-adv TOCTOU Race Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-64091

This vulnerability exists within the batman-adv kernel module, which implements a mesh routing protocol. Such protocols operate at the link layer within local or specialized mesh networks and are not designed or typically deployed to be reachable directly from the public internet.

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability has been resolved in the Linux kernel affecting the batman-adv module. This issue could potentially allow for data corruption or unauthorized access if exploited. The primary concern is to confirm if this specific technology is in use within your environment.

Race condition in mesh routing protocol resolved.
Confirms use of specific Linux kernel technology.
Assess relevance and potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker could exploit a timing issue in how the Linux kernel's batman-adv module handles reported VLANs. This race condition allows an attacker to send data that, under certain circumstances, could cause the system to allocate insufficient memory for storing VLAN information, potentially leading to system instability or compromise.

Network access needed.
Triggered by sending crafted network traffic.
Risk of denial-of-service or code execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could impact the integrity and availability of network routing information within the Linux kernel's batman-adv mesh networking component. Specifically, a time-of-check to time-of-use (TOCTOU) race condition in how reported VLANs are processed could lead to issues when the system calculates buffer sizes for VLAN data. This might result in insufficient buffer allocation, potentially causing unexpected service behavior or data corruption during the processing of network traffic within the mesh.

Network routing data.
Race condition during buffer allocation.
Potential for service instability.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability resides within the Linux kernel's batman-adv module, indicating that teams responsible for kernel maintenance, network infrastructure, or specialized mesh networking deployments should investigate. The first practical step involves identifying all systems running the affected kernel version, confirming their network exposure, and assessing business criticality to prioritize remediation efforts.

Kernel and infrastructure teams should own.
Verify network reachability and criticality.
Plan remediation based on risk assessment.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the batman-adv module in the Linux kernel?

The batman-adv (Better Approach To Mobile Ad-hoc Networking) module is a component of the Linux kernel used to manage mesh networking. It allows multiple devices to communicate by automatically routing traffic between them, creating a decentralized network. It is commonly utilized in specialized environments like community mesh networks or industrial wireless deployments where devices connect directly to each other rather than relying on a central access point.

How does this TOCTOU race condition work in CVE-2026-64091?

This is a Time-of-Check to Time-of-Use (TOCTOU) vulnerability. The system calculates how much memory to set aside for VLAN data, but because the actual number of entries can change slightly after the calculation but before the memory is used, the buffer may become too small. This mismatch between the allocated space and the actual data stored can lead to errors that destabilize the system or potentially allow for unauthorized memory access.

What triggers the vulnerability in the batman-adv module?

The vulnerability is triggered by sending specifically crafted network traffic to a device running the affected batman-adv module. It is important to note that this bug does not trigger during routine, healthy network operations where VLAN entry counts remain stable. The flaw is specifically tied to the internal timing of memory allocation during the processing of mesh routing information.

Do I need to worry about this if my system is internal?

According to Halo Surface Signal, this vulnerability is considered very unlikely to be reached from the public internet. Because batman-adv operates at the link layer within local or specialized mesh networks, it is not typically exposed to external traffic. You should focus your investigation on infrastructure where these mesh routing protocols are intentionally deployed to connect internal devices.

How should I respond to CVE-2026-64091?

Your first step is to audit your environment to identify which systems are currently running the batman-adv kernel module. Once identified, evaluate the network configuration of those specific machines to confirm their reachability. Focus your remediation efforts on systems that are critical to your mesh infrastructure, and coordinate with your kernel and infrastructure teams to apply the necessary stability updates once they become available for your Linux distribution.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.