Junglewise Threat Intelligence

CVE-2026-52931: Linux Kernel batman-adv uninitialized variable use in tp_meter

CVE-2026-52931 · Severity: info · CVSS 0 · Published 2026-06-24

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability exists in the Linux kernel's batman-adv networking module, which is used for managing mesh networks. A remote attacker can send a specially crafted network packet to a system acting as a receiver in a throughput test, causing the system to access uninitialized memory. This can lead to unpredictable system behavior or potential instability in mesh network environments.

Technical details

A vulnerability in net/batman-adv/tp_meter.c occurs because batadv_tp_recv_ack() and batadv_tp_stop() do not verify if the tp_vars structure is in the BATADV_TP_SENDER role before accessing sender-specific members. If a node acting as a BATADV_TP_RECEIVER receives a malicious ACK packet, it attempts to read uninitialized memory, resulting in undefined behavior. The fix introduces a role check immediately after the tp_vars lookup to ensure only sender-role structures are processed. This affects Linux kernels from version 4.8 up to various stable branches (e.g., fixed in 6.9.4, 6.6.33, 6.1.93).

Affected products

  • Linux Linux Kernel 4.8 to 6.9.3

Timeline

  • 2026-05-13: other: Vulnerability fix authored
  • 2026-06-24: disclosed: CVE published

References

Related threats