CVE-2026-64096

A flaw was found in the batman-adv (Better Approach To Mobile Ad-hoc Networking) multicast (mcast) module of the Linux kernel. The batadv_mcast_purge_orig() function removes entries from RCU (Read-Copy-Update)-protected lists without ensuring that all active readers have finished accessing those entries. This can lead to a use-after-free vulnerability, where concurrent operations may attempt to access memory that has already been released, potentially causing system instability or a denial of service.