https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 30 Sep 2026 23:34:36 +0000 https://vulnerability.circl.lu/vuln/cve-2026-52919 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>batman-adv: fix tp_meter counter underflow during shutdown</p> <p>batadv_tp_sender_shutdown() unconditionally decrements the &#34;sending&#34; atomic counter. If multiple paths (e.g. timeout, user cancel, and normal finish) call this function, the counter can underflow to -1.</p> <p>Since the sender logic treats any non-zero value as &#34;still sending&#34;, a negative value causes the sender kthread to loop indefinitely. This leads to a use-after-free when the interface is removed while the zombie thread is still active.</p> <p>Fix this by using atomic_xchg() to ensure the counter only transitions from 1 to 0 once.</p> <p>[sven: added missing change in batadv_tp_send]</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>batman-adv: fix tp_meter counter underflow during shutdown</p> <p>batadv_tp_sender_shutdown() unconditionally decrements the &#34;sending&#34; atomic counter. If multiple paths (e.g. timeout, user cancel, and normal finish) call this function, the counter can underflow to -1.</p> <p>Since the sender logic treats any non-zero value as &#34;still sending&#34;, a negative value causes the sender kthread to loop indefinitely. This leads to a use-after-free when the interface is removed while the zombie thread is still active.</p> <p>Fix this by using atomic_xchg() to ensure the counter only transitions from 1 to 0 once.</p> <p>[sven: added missing change in batadv_tp_send]</p> https://vulnerability.circl.lu/vuln/cve-2026-52919