CVE-2026-64092: batman-adv: tp_meter: fix tp_vars reference leak in receiver shutdown

[Greg Kroah-Hartman <gregkh@linuxfoundation.org>]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

batman-adv: tp_meter: fix tp_vars reference leak in receiver shutdown

The receiver shutdown timer handler, batadv_tp_receiver_shutdown(), is
responsible for releasing the tp_vars reference it holds. However, the
existing logic for coordinating this release with batadv_tp_stop_all() was
flawed.

timer_shutdown_sync() guarantees the timer will not fire again after it
returns, but it returns non-zero only when the timer was pending at the
time of the call. If the timer had already expired (and
batadv_tp_stop_all() would unsucessfully try to  rearm itself),
batadv_tp_stop_all() skips its batadv_tp_vars_put(), and
batadv_tp_receiver_shutdown() fails to put its own reference as well.

Fix this by introducing a new atomic variable receiving that is set to 1
when the receiver is initialized and cleared atomically with atomic_xchg()
by whichever side claims it first. Only the side that observes the
transition from 1 to 0 is responsible for releasing the tp_vars timer
reference, eliminating the uncertainty.

The Linux kernel CVE team has assigned CVE-2026-64092 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 6.6.140 with commit 79bc0eaeef2c5797317bf2da8e3159a74d62ec47 and fixed in 6.6.142 with commit 0b1bedf114ea93fef929b31f0d70a9eedcc601de
	Issue introduced in 6.12.90 with commit 26dfeee8db81354bfdade155f27f9e16510ad196 and fixed in 6.12.92 with commit a9f0bfd624ee8a286d6fd2bf0f796e730efb49b0
	Issue introduced in 6.18.32 with commit 03660dab86f93319178a24667f6998526dc4355d and fixed in 6.18.34 with commit b285bc0a97f43823a4967fb6d286de4c7f53d541
	Issue introduced in 7.0.9 with commit 8634c1dbd73adb74d40533ebb7e914efb82e71fb and fixed in 7.0.11 with commit d078501dde9b57210f1808cdef4b59463d1f5fc8
	Issue introduced in 5.10.259 with commit 5e7d0ac936354c36810e74ac3056b334ed1f4058

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-64092
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	net/batman-adv/tp_meter.c
	net/batman-adv/types.h


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/7715c73f33260af724d734c41b794457e9be8dbc
	https://git.kernel.org/stable/c/297e1bc4a915b7cd3e65a79ed906b23fb3d7aaae
	https://git.kernel.org/stable/c/0b1bedf114ea93fef929b31f0d70a9eedcc601de
	https://git.kernel.org/stable/c/a9f0bfd624ee8a286d6fd2bf0f796e730efb49b0
	https://git.kernel.org/stable/c/b285bc0a97f43823a4967fb6d286de4c7f53d541
	https://git.kernel.org/stable/c/d078501dde9b57210f1808cdef4b59463d1f5fc8
	https://git.kernel.org/stable/c/77098e4bea37af51d3962efa88a5af2ea5e1ac57