Executive brief
A flaw was found in the Batman Advanced (batman-adv) kernel module, which is used for managing mesh networks. Under specific conditions involving wireless interface management, the system can encounter a 'deadlock' where it stops responding or crashes. This could allow a local user to cause a denial-of-service, impacting the availability of the network and the host system.
Technical details
A locking issue exists in the batman-adv module's batadv_v_elp_get_throughput() function. The vulnerability is caused by an improper locking sequence (double-rtnl_lock) when retrieving throughput metrics for cfg80211 interfaces. Specifically, if the RTNL lock is already held when a work queue item is cancelled via cancel_delayed_work_sync(), a subsequent call to rtnl_lock() within batadv_get_real_netdev() results in a deadlock. The fix involves using rtnl_trylock() and a lockless version of the device retrieval function (__batadv_get_real_netdev). This is a local attack vector requiring low privileges to trigger interface state changes or wait for specific work queue timings.
Affected products
- Linux Linux kernel 5.4.291 to 5.5; 5.10.235 to 5.10.253; 5.15.179 to 5.15.203; 6.1.129 to 6.1.167; 6.6.79 to 6.6.130; 6.12.16 to 6.12.78; 6.13.4 to 6.14; 6.19 to 6.19.9
Timeline
- 2026-05-08: advisory: Initial disclosure and CVE assignment
- 2026-02-16: patched: Patch authored by Sven Eckelmann
References
- https://git.kernel.org/stable/c/192f40ad8a7dac58dae9199a065dbf7e6e67b75b
- https://git.kernel.org/stable/c/2ab9f2531d37775cd79228c1f5d80e6bd08d11d3
- https://git.kernel.org/stable/c/4c3ae249431b4fcb315d7dfb4c3a13f9e443fd9b
- https://git.kernel.org/stable/c/77808fe7d03ad0062840b95f431869a8b3d88b24
- https://git.kernel.org/stable/c/b7e5d8ddfdf1d6e9e0808d1adf7736a107372d77
- https://git.kernel.org/stable/c/cfc83a3c71517b59c1047db57da31e26a9dc2f33
- https://git.kernel.org/stable/c/f3ca45673dab0514a887231de6f3243a699d5bfd