Executive brief
A vulnerability exists in the Linux kernel's batman-adv networking module, which is used for managing mesh networks. A remote attacker can send a specially crafted network packet to a system acting as a receiver in a throughput test, causing the system to access uninitialized memory. This can lead to unpredictable system behavior or potential instability in mesh network environments.
Technical details
A vulnerability in net/batman-adv/tp_meter.c occurs because batadv_tp_recv_ack() and batadv_tp_stop() do not verify if the tp_vars structure is in the BATADV_TP_SENDER role before accessing sender-specific members. If a node acting as a BATADV_TP_RECEIVER receives a malicious ACK packet, it attempts to read uninitialized memory, resulting in undefined behavior. The fix introduces a role check immediately after the tp_vars lookup to ensure only sender-role structures are processed. This affects Linux kernels from version 4.8 up to various stable branches (e.g., fixed in 6.9.4, 6.6.33, 6.1.93).
Affected products
- Linux Linux Kernel 4.8 to 6.9.3
Timeline
- 2026-05-13: other: Vulnerability fix authored
- 2026-06-24: disclosed: CVE published
References
- https://git.kernel.org/stable/c/0e388af04b3958b178a1b979527f93eb46ea1fee
- https://git.kernel.org/stable/c/1a21c055f66e78973712a4a1be2a554f1ee2e4f4
- https://git.kernel.org/stable/c/53f931e0146ae5bdab4cba302646827d06b3794b
- https://git.kernel.org/stable/c/6c65cf23d4c6170fcf5714c32aa64689718cb142
- https://git.kernel.org/stable/c/85397e48afe6be83ffca5ad3f4792296bfc81d3d
- https://git.kernel.org/stable/c/9884c9c02d3c90e9215db3c5128f59045d20ae91
- https://git.kernel.org/stable/c/dc2ae5fbd2dadc26735092f140b246841d969a11