CVE-2026-64218: batman-adv: bla: fix report_work leak on backbone_gw purge

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

batman-adv: bla: fix report_work leak on backbone_gw purge

batadv_bla_purge_backbone_gw() removes stale backbone gateway entries,
but fails to properly handle their associated report_work:

- If report_work is running, the purge must wait for it to finish before
  freeing the backbone_gw, otherwise the worker may access freed memory
  (e.g. bat_priv).
- If report_work is pending, the purge must cancel it and release the
  reference held for that pending work item.

The previous implementation called hlist_for_each_entry_safe() inside a
spin_lock_bh() section, but cancel_work_sync() may sleep and therefore
cannot be called from within a spinlock-protected region.

Restructure the loop to handle one entry per spinlock critical section:
acquire the lock, find the next entry to purge, remove it from the hash
list, then release the lock before calling cancel_work_sync() and
dropping the hash_entry reference. Repeat until no more entries require
purging.

The Linux kernel CVE team has assigned CVE-2026-64218 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 3.5 with commit 23721387c409087fd3b97e274f34d3ddc0970b74 and fixed in 5.10.258 with commit ce2c0ee4d76d5ee4b391fe0e31334361e25030ec
	Issue introduced in 3.5 with commit 23721387c409087fd3b97e274f34d3ddc0970b74 and fixed in 5.15.209 with commit 3423a45e5c3d3c5129f88143a9a969787d7d5a0a
	Issue introduced in 3.5 with commit 23721387c409087fd3b97e274f34d3ddc0970b74 and fixed in 6.1.175 with commit f1303adb1e59582f76c22798a2e2e150e054a9e7
	Issue introduced in 3.5 with commit 23721387c409087fd3b97e274f34d3ddc0970b74 and fixed in 6.6.142 with commit 48663158222b3b7f6ee6791a67d512ede7fc94bb
	Issue introduced in 3.5 with commit 23721387c409087fd3b97e274f34d3ddc0970b74 and fixed in 6.12.92 with commit eeddd7bab3d59c1e98642a204141f8c5d6194707
	Issue introduced in 3.5 with commit 23721387c409087fd3b97e274f34d3ddc0970b74 and fixed in 6.18.34 with commit c6de1a5a9c406e30b91f1515a6ce05cc84023baa
	Issue introduced in 3.5 with commit 23721387c409087fd3b97e274f34d3ddc0970b74 and fixed in 7.0.11 with commit 95a7034661274cf5985708bd2f6d86ee46f88fa9
	Issue introduced in 3.5 with commit 23721387c409087fd3b97e274f34d3ddc0970b74 and fixed in 7.1 with commit 0459430add32ea41f3e2ef9351610e6d33627a6b

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-64218
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	net/batman-adv/bridge_loop_avoidance.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/ce2c0ee4d76d5ee4b391fe0e31334361e25030ec
	https://git.kernel.org/stable/c/3423a45e5c3d3c5129f88143a9a969787d7d5a0a
	https://git.kernel.org/stable/c/f1303adb1e59582f76c22798a2e2e150e054a9e7
	https://git.kernel.org/stable/c/48663158222b3b7f6ee6791a67d512ede7fc94bb
	https://git.kernel.org/stable/c/eeddd7bab3d59c1e98642a204141f8c5d6194707
	https://git.kernel.org/stable/c/c6de1a5a9c406e30b91f1515a6ce05cc84023baa
	https://git.kernel.org/stable/c/95a7034661274cf5985708bd2f6d86ee46f88fa9
	https://git.kernel.org/stable/c/0459430add32ea41f3e2ef9351610e6d33627a6b