CVE-2026-64091

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> batman-adv: tt: fix TOCTOU race for reported vlans<br /> <br /> The local TT based TVLV is generated by first checking the number of VLANs<br /> which have at least one TT entry. A new buffer with the correct size for<br /> the VLANs is then allocated. Only then, the list of VLANs s used to fill<br /> the VLAN entries in the buffer. During this time, the meshif_vlan_list_lock<br /> is held. But the actual number of TT entries of each VLAN can still<br /> increase during this time - just not the number of VLANs in the list.<br /> <br /> But the prefilter used in the buffer size calculation might still cause an<br /> increase of the number of VLANs which need to be stored. Simply because a<br /> VLAN might now suddenly have at least one entry when it had none in the<br /> pre-alloc check - and then needs to occupy space which was not allocated.<br /> <br /> It is better to overestimate the buffer size at the beginning and then fill<br /> the buffer only with the VLANs which are not empty.