Executive brief
A vulnerability exists in the Linux kernel's batman-adv module, which is used for managing mobile ad-hoc networks. The flaw involves improper management of internal gateway references, which can lead to system instability or crashes. In a worst-case scenario, this could allow an attacker to disrupt network operations or potentially gain unauthorized access to system memory.
Technical details
A vulnerability in the batman-adv module of the Linux kernel arises from improper reference counting of backbone gateway objects within the Bridge Loop Avoidance (BLA) logic. Specifically, the function batadv_bla_add_claim() can replace a gateway reference and drop its last reference count while other threads (such as netlink dump or claim check paths) are still dereferencing the pointer. This 'naked pointer' access pattern can result in a NULL pointer dereference or use-after-free. An attacker could potentially exploit this via network-delivered packets that trigger BLA claim updates or checks, leading to a kernel crash or arbitrary code execution. The fix involves ensuring readers hold a stable reference to the gateway until their operations are complete.
Affected products
- Linux Linux Kernel 3.5.1 to 6.1.169, 6.2 to 6.6.135, 6.7 to 6.12.82, 6.13 to 6.18.23, 6.19 to 6.19.13, 7.0-rc1 to 7.0-rc7
Timeline
- 2026-04-24: advisory: Initial disclosure by kernel.org
- 2026-04-24: disclosed
- 2026-04-18: patched: Patches committed to stable trees by Greg Kroah-Hartman
References
- https://git.kernel.org/stable/c/1f2dc36c297d27733f1b380ea644cf15a361bd7b
- https://git.kernel.org/stable/c/2f55b58b5a0bbed192d60c444a45a49cdf1b545f
- https://git.kernel.org/stable/c/4dee4c0688443aaf5bbec74aa203c851d1d53c35
- https://git.kernel.org/stable/c/5202f071b367ffbc8e279fc7a00db14f5e587f52
- https://git.kernel.org/stable/c/69d1ce9c72eca91203ffdb8d08bacd511100aec6
- https://git.kernel.org/stable/c/7962b522222628596ca9ecc8722efc95367aadbd
- https://git.kernel.org/stable/c/82d8701b2c930d0e96b0dbc9115a218d791cb0d2