Executive brief
A vulnerability was identified in the Linux kernel's 'batman-adv' module, which is used for managing mesh networks. A flaw in how the system handles network 'claims' during deletion could lead to a system crash or unpredictable behavior. This issue primarily affects the stability of devices using this specific networking protocol, such as specialized wireless mesh routers.
Technical details
A use-after-free (UAF) vulnerability exists in the batman-adv module within the Bridge Loop Avoidance (BLA) component. The function batadv_bla_del_backbone_claims() incorrectly ordered the decrement of an object's reference count (via batadv_claim_put) before removing the object from a hash list (hlist_del_rcu). If the reference count dropped to zero, the claim object could be freed by batadv_claim_release() while the code was still attempting to access its hash_entry member. This is a local vulnerability that can lead to kernel memory corruption or a denial-of-service (system crash). The issue has been resolved by reordering the operations to ensure the reference is only released after the last access to the object.
Affected products
- Linux Linux Kernel All versions including batman-adv bridge loop avoidance
Timeline
- 2026-05-06: other: Patch authored by Sven Eckelmann
- 2026-05-28: disclosed: CVE published in NVD dataset
References
- https://git.kernel.org/stable/c/00155f336a5e8b1006d2ca9ae7ad8fc4a44bb401
- https://git.kernel.org/stable/c/0cc9847c64cb6e61118bc78c9187c8209a7197fa
- https://git.kernel.org/stable/c/368449e467d5f1e2c2e987bf2bd57000ba75e10b
- https://git.kernel.org/stable/c/4ae1709a314060a196981b344610d023ea841e57
- https://git.kernel.org/stable/c/6c5dc6d68e6ba7f0224a757a39ed52fcdb54d472