Executive brief
A vulnerability in the Linux kernel's batman-adv networking module could allow a local attacker to crash the system. The issue stems from how the system tracks the size of network packet fragments during reassembly. By sending specially crafted fragments, an attacker can cause the system to miscalculate data lengths, leading to a denial of service.
Technical details
An integer truncation vulnerability exists in the batman-adv module's fragment reassembly logic (net/batman-adv/fragmentation.c). The module maintains a running payload length for queued fragments using a 16-bit field (u16), which can be truncated during updates when processing malformed fragment chains. This allows an attacker to bypass validation checks and trigger reassembly with an inconsistent length state. The fix involves upgrading the length field to size_t and implementing overflow checks using check_add_overflow() before validation. This issue can be exploited by a local user to cause a kernel panic or system hang (Denial of Service).
Affected products
- Linux Linux Kernel 3.13 to 6.14
Timeline
- 2026-06-24: disclosed
- 2026-06-24: advisory
References
- https://git.kernel.org/stable/c/37be61825b15534a16ff9cfc9546de155b6df982
- https://git.kernel.org/stable/c/3eb8bcb823391bd58997831b3c9c152a4ba8e255
- https://git.kernel.org/stable/c/975563c5de1123dde1ec7946bf5556d20c89d74e
- https://git.kernel.org/stable/c/9cd3f16c320bfdadd4509358122368deb56a5741
- https://git.kernel.org/stable/c/e4f3f6b818aa6a678bc54a2d4e0bece2303c6a64
- https://git.kernel.org/stable/c/e910dbf509125fe51ad68e4fa74dc8ab0a8e787a
- https://git.kernel.org/stable/c/f653b040dad1af70fa5cd4fe085e4758925480c9