Executive brief
A vulnerability was identified in the Linux kernel's batman-adv networking module, which is used for managing mesh networks. Under specific conditions where system memory is extremely low, the system could crash when attempting to process certain network discovery packets. This could lead to a service outage for devices relying on this specific mesh networking protocol.
Technical details
A vulnerability exists in the batman-adv kernel module within the Distributed ARP Table (DAT) implementation. The function batadv_dat_forward_data() calls pskb_copy_for_clone() to duplicate socket buffers (skb) for DHT candidates but fails to validate the return value. If memory allocation fails and returns NULL, the subsequent call to batadv_send_skb_prepare_unicast_4addr() dereferences the NULL pointer, causing a kernel panic. This issue affects Linux kernels from version 3.8 onwards. Patches have been released across multiple stable branches to include proper null checks and skip forwarding on allocation failure.
Affected products
- Linux Linux Kernel 3.8 to 5.10.258, 5.15.209, 6.1.175, 6.6.x, 6.12.x
Timeline
- 2026-05-13: other: Patch authored by Sven Eckelmann
- 2026-06-24: advisory: CVE-2026-52922 published by NVD
References
- https://git.kernel.org/stable/c/2d8826a2d3657cea66fb0370f9e521575a673871
- https://git.kernel.org/stable/c/2edb8aeb3cdda9d00ec4997252dc5bcd6f54d8ef
- https://git.kernel.org/stable/c/4d420d9ee70a220a2cd95aa0dd2e15acad66a505
- https://git.kernel.org/stable/c/866ac1d57040ed0b44ca732e3c66b3aa6b93011c
- https://git.kernel.org/stable/c/9bcebaedfb8479cb4affb23c7a0d000ca9a20e73
- https://git.kernel.org/stable/c/9cceea8eeba710def2a5707ee00f00c74a9a1cac
- https://git.kernel.org/stable/c/ce0c381199402a2c58f4599f4f6ed100d872d0da