Executive brief
A vulnerability in the Linux kernel's batman-adv mesh networking component could allow a remote attacker to crash the system. By sending specially crafted network packets that contain nested fragments, an attacker can cause the system's memory to overflow, leading to a complete service outage. This affects systems using B.A.T.M.A.N. Advanced routing for wireless mesh networks.
Technical details
A vulnerability exists in the batman-adv kernel module's fragmentation handling logic. The function batadv_frag_skb_buffer() is triggered upon receipt of BATADV_UNICAST_FRAG packets; once reassembled, the payload is passed back to batadv_batman_skb_recv() for processing. A remote attacker can craft 'matryoshka-style' nested fragments where the reassembled payload is itself another fragment. This causes infinite recursion in the kernel stack, leading to a stack overflow and kernel panic (Denial of Service). The fix introduces a check to discard any packets that remain in a fragmented state after the initial defragmentation process.
Affected products
- Linux Linux Kernel 3.12 to 6.9.x
Timeline
- 2026-05-13: other: Patch authored
- 2026-06-01: patched: Patch committed to stable tree
- 2026-06-24: disclosed: CVE published
References
- https://git.kernel.org/stable/c/0c208fa3859e3a33a1c38bebc41d021166e94ac8
- https://git.kernel.org/stable/c/5418be6c2e117bf8a316582795a8e3ff90f45e5d
- https://git.kernel.org/stable/c/5895ad21c7059a652da83fb817510f7a1e962abf
- https://git.kernel.org/stable/c/7138c35c9ad39a2fca6264af6b87466471f04ffc
- https://git.kernel.org/stable/c/aea54d0bbe156d5ab7d00d68f66149ff41f4612a
- https://git.kernel.org/stable/c/b54e459cf86943583c1aa2ee3081874e7ab1f5f3
- https://git.kernel.org/stable/c/bc62216dc8e221e3781afa14430f45208bfa9af9