In the Linux kernel, the following vulnerability has been resolved:
batman-adv: tpmeter: fix tpvars reference leak in receiver shutdown
The receiver shutdown timer handler, batadvtpreceivershutdown(), is responsible for releasing the tpvars reference it holds. However, the existing logic for coordinating this release with batadvtpstop_all() was flawed.
timershutdownsync() guarantees the timer will not fire again after it returns, but it returns non-zero only when the timer was pending at the time of the call. If the timer had already expired (and batadvtpstopall() would unsucessfully try to rearm itself), batadvtpstopall() skips its batadvtpvarsput(), and batadvtpreceivershutdown() fails to put its own reference as well.
Fix this by introducing a new atomic variable receiving that is set to 1 when the receiver is initialized and cleared atomically with atomicxchg() by whichever side claims it first. Only the side that observes the transition from 1 to 0 is responsible for releasing the tpvars timer reference, eliminating the uncertainty.
{
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/64xxx/CVE-2026-64092.json",
"cna_assigner": "Linux"
}