CVE-2026-64094
kernel: batman-adv: bla: avoid NULL-ptr deref for claim via dropped interface
Severity
LowRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · July 19, 2026
Updated · September 9, 2026
Description
A flaw was found in the Linux kernel's batman-adv (Better Approach To Mobile Ad-hoc Networking - Advanced) component, specifically within its Bridge Loop Avoidance (BLA) feature. This vulnerability occurs when a network interface is unexpectedly removed while the system attempts to send an Address Resolution Protocol (ARP) request. This can lead to a null-pointer dereference, which may cause the system to crash, resulting in a denial of service.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.1 · 5.5CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-476 · NULL Pointer Dereference