CVE-2026-64096

In the Linux kernel, the following vulnerability has been resolved:

batman-adv: mcast: fix use-after-free in orig_node RCU release

batadvmcastpurgeorig() removes entries from RCU-protected hlists but does not wait for an RCU grace period before returning. Concurrent RCU readers may still accesses references to those entries at the point of removal. RCU-protected readers trying to operate on entries like orig->mcastwantallipv6_node will then access already freed memory.

Fix this by moving batadvmcastpurgeorig() to batadvorignoderelease(), just before the callrcu() invocation. This ensures RCU readers that were active at purge time have drained before the orignode memory is reclaimed.