Homepage

CVE-2026-64093 Affecting kernel-uek-debug-modules-extra package, versions <0:6.12.0-206.104.3.3.el10uek

Severity

 Recommended
high

Based on Oracle Linux security rating.

Threat Intelligence

EPSS
0.34% (27th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-ORACLE10-KERNELUEKDEBUGMODULESEXTRA-19568120
  • published5 Sept 2026
  • disclosed19 Jul 2026
Report a new vulnerability Found a mistake?

Introduced: 19 Jul 2026

CVE-2026-64093  (opens in a new tab)

How to fix?

Upgrade Oracle:10 kernel-uek-debug-modules-extra to version 0:6.12.0-206.104.3.3.el10uek or higher.
This issue was patched in ELSA-2026-500248.

NVD Description

Note: Versions mentioned in the description apply only to the upstream kernel-uek-debug-modules-extra package and not the kernel-uek-debug-modules-extra package as distributed by Oracle. See How to fix? for Oracle:10 relevant fixed versions and status.

In the Linux kernel, the following vulnerability has been resolved:

batman-adv: tp_meter: directly shut down timer on cleanup

batadv_tp_sender_cleanup() was calling timer_delete_sync() followed by timer_delete() to guard against the timer handler re-arming itself between the two calls. This double-deletion hack relied on the sending status being set to 0 to suppress re-arming.

Replace both calls with a single timer_shutdown_sync(). This function both waits for any running timer callback to complete (like timer_delete_sync()) and permanently disarms the timer so it cannot be re-armed afterwards, making re-arming prevention unconditional and self-documenting.

The re-arming property is also required because otherwise:

  1. context 0 (batadv_tp_recv_ack()) checks in batadv_tp_reset_sender_timer() if sending is still 1 -> it is
  2. context 1 changes in batadv_tp_sender_shutdown() sending to 0 and in this process forces the kthread to stop timer in batadv_tp_sender_cleanup()
  3. context 0 continues in batadv_tp_reset_sender_timer() and rearms the timer -> but the reference for it is already gone