CVE-2026-64218

In the Linux kernel, the following vulnerability has been resolved:

batman-adv: bla: fix reportwork leak on backbonegw purge

batadvblapurgebackbonegw() removes stale backbone gateway entries, but fails to properly handle their associated report_work:

• If reportwork is running, the purge must wait for it to finish before freeing the backbonegw, otherwise the worker may access freed memory (e.g. bat_priv).
• If report_work is pending, the purge must cancel it and release the reference held for that pending work item.

The previous implementation called hlistforeachentrysafe() inside a spinlockbh() section, but cancelworksync() may sleep and therefore cannot be called from within a spinlock-protected region.

Restructure the loop to handle one entry per spinlock critical section: acquire the lock, find the next entry to purge, remove it from the hash list, then release the lock before calling cancelworksync() and dropping the hash_entry reference. Repeat until no more entries require purging.