Executive brief
A vulnerability was identified in the Linux kernel's batman-adv networking module, which is used for managing mesh networks. Under specific conditions, the system may attempt to access memory that has already been cleared, leading to a system crash. This could result in a denial-of-service, impacting the availability of network connectivity for devices relying on this mesh protocol.
Technical details
A race condition exists in the Bridge Loop Avoidance (BLA) component of the batman-adv module. Specifically, the function `batadv_bla_purge_claims()` traverses a hash list using only an RCU read lock. If a parallel `batadv_claim_put()` triggers `batadv_claim_release()`, the `backbone_gw` pointer may be set to NULL before the RCU grace period ends. Subsequent calls to `batadv_bla_claim_get_backbone_gw()` on that claim result in a NULL pointer dereference. The fix introduces a check using `kref_get_unless_zero` to ensure only claims with a valid reference counter are processed during purging.
Affected products
- Linux Linux kernel All versions including batman-adv bridge loop avoidance
Timeline
- 2026-05-06: patched: Patch authored by Sven Eckelmann
- 2026-05-28: disclosed: CVE published in NVD dataset
References
- https://git.kernel.org/stable/c/7b7ebb7222a5524ce58e48cc9c6d688320ea6cfe
- https://git.kernel.org/stable/c/7b8fbcee3184d848b5aee085ca16d0cf05c9b641
- https://git.kernel.org/stable/c/ab3dbd07a809a8eb30c7ddfab9ac886ed30dce8d
- https://git.kernel.org/stable/c/b65365d2b1e6095c538d49baeb140dd1c166c1b3
- https://git.kernel.org/stable/c/cf6b604011591865ae39ac82de8978c1120d17af