Executive brief
A vulnerability was identified in the Linux kernel's B.A.T.M.A.N. Advanced (batman-adv) mesh networking protocol. The 'throughput meter' component failed to properly stop new sessions while the network interface was being shut down. This could potentially lead to system instability or crashes during network reconfiguration or teardown.
Technical details
A race condition exists in the batman-adv module's throughput meter (tp_meter) implementation. The functions batadv_tp_start, batadv_tp_init_recv, and batadv_tp_meter_recv did not check the mesh_state before initiating or processing sessions. This allowed new sender or receiver sessions to start even after the mesh state had left BATADV_MESH_ACTIVE during teardown. An attacker on the local mesh network could potentially exploit this to cause a kernel panic or undefined behavior by sending TP packets during interface deactivation. The fix introduces atomic checks for the BATADV_MESH_ACTIVE state within the tp_meter component.
Affected products
- Linux Linux Kernel All versions prior to the fix in 2026
Timeline
- 2026-04-27: other: Patch authored
- 2026-05-28: advisory: CVE-2026-46206 published by NVD
References
- https://git.kernel.org/stable/c/3243543592425beec83d453793e9d27caa0d8e66
- https://git.kernel.org/stable/c/ca39545cf07c142b39d474a1439a046bf28def3d
- https://git.kernel.org/stable/c/e1e2194cc725ec1d41f9412496212f0fa0519c36
- https://git.kernel.org/stable/c/e4a3c4a4c8f6efd243c3e448c05b7bebcbf7b3b6
- https://git.kernel.org/stable/c/ff93f86ecbb50a4709c403fc279a396e308edde5