CVE-2026-64096: batman-adv: mcast: fix use-after-free in orig_node RCU release

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

batman-adv: mcast: fix use-after-free in orig_node RCU release

batadv_mcast_purge_orig() removes entries from RCU-protected hlists but
does not wait for an RCU grace period before returning. Concurrent RCU
readers may still accesses references to those entries at the point of
removal. RCU-protected readers trying to operate on entries like
orig->mcast_want_all_ipv6_node will then access already freed memory.

Fix this by moving batadv_mcast_purge_orig() to batadv_orig_node_release(),
just before the call_rcu() invocation. This ensures RCU readers that were
active at purge time have drained before the orig_node memory is reclaimed.

The Linux kernel CVE team has assigned CVE-2026-64096 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 3.15 with commit ab49886e3da73b6b35ece21006e191910427bb30 and fixed in 5.10.258 with commit ff3a4487ead475e27b43280b8ee3d8464fe280e1
	Issue introduced in 3.15 with commit ab49886e3da73b6b35ece21006e191910427bb30 and fixed in 5.15.209 with commit 78a63fb2f7d5630d1c1f2859a20d4e4226863b41
	Issue introduced in 3.15 with commit ab49886e3da73b6b35ece21006e191910427bb30 and fixed in 6.1.175 with commit ced48f55bac73f0822eae90509e51b42b4f646c8
	Issue introduced in 3.15 with commit ab49886e3da73b6b35ece21006e191910427bb30 and fixed in 6.6.142 with commit 70bcb678561f0fb58f33270fc73f12f3be72b878
	Issue introduced in 3.15 with commit ab49886e3da73b6b35ece21006e191910427bb30 and fixed in 6.12.92 with commit aef897c9d2dd0d9339167fb82b62beff68d076cb
	Issue introduced in 3.15 with commit ab49886e3da73b6b35ece21006e191910427bb30 and fixed in 6.18.34 with commit 8a3707653ab658e082ccd992e92594e01b09a3fc
	Issue introduced in 3.15 with commit ab49886e3da73b6b35ece21006e191910427bb30 and fixed in 7.0.11 with commit edfb1e094104a50f931553dc82ac59246569fd32
	Issue introduced in 3.15 with commit ab49886e3da73b6b35ece21006e191910427bb30 and fixed in 7.1 with commit 20c2d6a20ca936f5aaa6dd40f73f262ac45c87cc

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-64096
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	net/batman-adv/originator.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/ff3a4487ead475e27b43280b8ee3d8464fe280e1
	https://git.kernel.org/stable/c/78a63fb2f7d5630d1c1f2859a20d4e4226863b41
	https://git.kernel.org/stable/c/ced48f55bac73f0822eae90509e51b42b4f646c8
	https://git.kernel.org/stable/c/70bcb678561f0fb58f33270fc73f12f3be72b878
	https://git.kernel.org/stable/c/aef897c9d2dd0d9339167fb82b62beff68d076cb
	https://git.kernel.org/stable/c/8a3707653ab658e082ccd992e92594e01b09a3fc
	https://git.kernel.org/stable/c/edfb1e094104a50f931553dc82ac59246569fd32
	https://git.kernel.org/stable/c/20c2d6a20ca936f5aaa6dd40f73f262ac45c87cc