CVE-2026-64095

In the Linux kernel, the following vulnerability has been resolved:

batman-adv: bla: avoid double decrement of bla.num_requests

The bla.numrequests is increased when no requestsent was in progress. And it is decremented in various places (announcement was received, backbone is purged, periodic work). But the check if the requestsent is actually set to a specific state and the atomicdec/_inc are not safe because they are not atomic (TOCTOU) and multiple such code portions can run concurrently.

At the same time, it is necessary to modify requestsent (state) and bla.numrequests atomically. Otherwise batadvblasendrequest() might set requestsent to 1 and is interrupted. batadvhandleannounce() can then set requestsent back to 0 and decrement numrequests before batadvblasend_request() incremented it.

The two operations must therefore be locked. And since state (requestsent) and waitperiods are only accessed inside this lock, they can be converted to simpler datatypes. And to avoid that the bla.numrequests is touched by a parallel running context with a valid backbonegw reference after batadvblapurgebackbonegw() ran, a third state "stopped" is required to correctly signal that a backbone_gw is in the state of being cleaned up.