Junglewise Threat Intelligence

CVE-2026-46233: Linux Kernel batman-adv NULL pointer dereference in BLA

CVE-2026-46233 · Severity: info · CVSS 5.5 · Published 2026-05-28

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability was identified in the Linux kernel's batman-adv networking module, which is used for managing mesh networks. Under specific conditions, the system may attempt to access memory that has already been cleared, leading to a system crash. This could result in a denial-of-service, impacting the availability of network connectivity for devices relying on this mesh protocol.

Technical details

A race condition exists in the Bridge Loop Avoidance (BLA) component of the batman-adv module. Specifically, the function `batadv_bla_purge_claims()` traverses a hash list using only an RCU read lock. If a parallel `batadv_claim_put()` triggers `batadv_claim_release()`, the `backbone_gw` pointer may be set to NULL before the RCU grace period ends. Subsequent calls to `batadv_bla_claim_get_backbone_gw()` on that claim result in a NULL pointer dereference. The fix introduces a check using `kref_get_unless_zero` to ensure only claims with a valid reference counter are processed during purging.

Affected products

  • Linux Linux kernel All versions including batman-adv bridge loop avoidance

Timeline

  • 2026-05-06: patched: Patch authored by Sven Eckelmann
  • 2026-05-28: disclosed: CVE published in NVD dataset

References

Related threats