CVE-2026-64093: Software Security Vulnerability Vulnerability

HIGH
Advisory Identifier: GHSA-qf88-xw8w-824g
Share
CVSS 8.8
Published
Advisory Summary

CVE-2026-64093 is a HIGH (CVSS 8.8) security vulnerability vulnerability (General Security Weakness) affecting Software libraries in the Maven ecosystem. Remediation is available in the latest vendor maintenance releases.

CVE-2026-64093 at a Glance

CVE Identifier CVE-2026-64093
GHSA Identifier GHSA-qf88-xw8w-824g
Severity HIGH
CVSS v3.1 Base Score 8.8
CWE Classification General Security Weakness
Affected Product Software
Package Ecosystem Maven
Published Date
Last Updated

Security Impact

CVSS: 8.8

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Attack Vector Adjacent (AV:A)
Attack Complexity Low (AC:L)
Privileges Required None (PR:N)
User Interaction None (UI:N)
Scope Unchanged (S:U)
Confidentiality High (C:H)
Integrity High (I:H)
Availability High (A:H)

How to Fix CVE-2026-64093

To remediate this vulnerability, upgrade all affected Software dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

mvn dependency:tree

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2026-64093, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree

Analyze the terminal output to locate any version of Software in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.

Note: The mvn dependency:tree command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under General Security Weakness. In Software, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

In the Linux kernel, the following vulnerability has been resolved: batman-adv: tp_meter: directly shut down timer on cleanup batadv_tp_sender_cleanup() was calling timer_delete_sync() followed by timer_delete() to guard against the timer handler re-arming itself between the two calls. This double-deletion hack relied on the sending status being set to 0 to suppress re-arming. Replace both calls with a single timer_shutdown_sync(). This function both waits for any running timer callback to complete (like timer_delete_sync()) and permanently disarms the timer so it cannot be re-armed afterwards, making re-arming prevention unconditional and self-documenting. The re-arming property is also required because otherwise: 1. context 0 (batadv_tp_recv_ack()) checks in batadv_tp_reset_sender_timer() if sending is still 1 -> it is 2. context 1 changes in batadv_tp_sender_shutdown() sending to 0 and in this process forces the kthread to stop timer in batadv_tp_sender_cleanup() 3. context 0 continues in batadv_tp_reset_sender_timer() and rearms the timer -> but the reference for it is already gone

References

NVD — CVE-2026-64093 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-64093
git.kernel.org/stable/c/00bf4bb994... WEB
https://git.kernel.org/stable/c/00bf4bb9947b1190a8be8d9b6a1bcbfa3707785c
git.kernel.org/stable/c/5bc2d50fb6... WEB
https://git.kernel.org/stable/c/5bc2d50fb66b46f86543d5153a188eb1486d0b6e
git.kernel.org/stable/c/74a7663405... WEB
https://git.kernel.org/stable/c/74a76634055462833446684fd526d73c290ea43a
git.kernel.org/stable/c/770bf0a35f... WEB
https://git.kernel.org/stable/c/770bf0a35f0620b526fd4193889d1e77084e4c43
git.kernel.org/stable/c/933880a8bc... WEB
https://git.kernel.org/stable/c/933880a8bc9b4042223a79255c0b1021cdc36991
git.kernel.org/stable/c/d5487249a8... WEB
https://git.kernel.org/stable/c/d5487249a81ea658717614009c8f46acc5b7101a
git.kernel.org/stable/c/f86b20ec8d... WEB
https://git.kernel.org/stable/c/f86b20ec8d17d77bddc02c5c86cfa2389d84ecff

Frequently Asked Questions

What is CVE-2026-64093?
CVE-2026-64093 is a security vulnerability in Software classified as a security vulnerability vulnerability under General Security Weakness.
Which Software versions are affected?
Affected versions include releases prior to current release patches.
What version fixes CVE-2026-64093?
Upgrading to current release patches (or the latest patched release for your respective branch) resolves the vulnerability.
What is the CVSS score of CVE-2026-64093?
CVE-2026-64093 has a CVSS v3.1 base score of 8.8 (HIGH) with vector string CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
What CWE is associated with CVE-2026-64093?
CVE-2026-64093 is classified under General Security Weakness.
How can I check Maven dependencies for CVE-2026-64093?
Run the dependency tree command: 'mvn dependency:tree'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-qf88-xw8w-824g",
  "modified" : "2026-07-20T15:31:59Z",
  "published" : "2026-07-19T18:31:51Z",
  "aliases" : [ "CVE-2026-64093" ],
  "details" : "In the Linux kernel, the following vulnerability has been resolved:\n\nbatman-adv: tp_meter: directly shut down timer on cleanup\n\nbatadv_tp_sender_cleanup() was calling timer_delete_sync() followed by\ntimer_delete() to guard against the timer handler re-arming itself between\nthe two calls. This double-deletion hack relied on the sending status being\nset to 0 to suppress re-arming.\n\nReplace both calls with a single timer_shutdown_sync(). This function both\nwaits for any running timer callback to complete (like timer_delete_sync())\nand permanently disarms the timer so it cannot be re-armed afterwards,\nmaking re-arming prevention unconditional and self-documenting.\n\nThe re-arming property is also required because otherwise:\n\n1. context 0 (batadv_tp_recv_ack()) checks in\n   batadv_tp_reset_sender_timer() if sending is still 1 -> it is\n2. context 1 changes in batadv_tp_sender_shutdown() sending to 0 and in\n   this process forces the kthread to stop timer in\n   batadv_tp_sender_cleanup()\n3. context 0 continues in batadv_tp_reset_sender_timer() and rearms the\n   timer -> but the reference for it is already gone",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  } ],
  "affected" : [ ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-64093"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/00bf4bb9947b1190a8be8d9b6a1bcbfa3707785c"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/5bc2d50fb66b46f86543d5153a188eb1486d0b6e"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/74a76634055462833446684fd526d73c290ea43a"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/770bf0a35f0620b526fd4193889d1e77084e4c43"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/933880a8bc9b4042223a79255c0b1021cdc36991"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/d5487249a81ea658717614009c8f46acc5b7101a"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/f86b20ec8d17d77bddc02c5c86cfa2389d84ecff"
  } ],
  "database_specific" : {
    "cwe_ids" : [ ],
    "severity" : "HIGH",
    "github_reviewed" : false,
    "github_reviewed_at" : null,
    "nvd_published_at" : "2026-07-19T16:17:50Z"
  }
}