Executive brief
A vulnerability was identified in the Linux kernel's 'batman-adv' module, which is used for managing mesh networks. The issue involves how the system handles network translation tables, potentially leading to inconsistent network states or 'request storms' that can degrade network performance. This could impact the stability and availability of specialized wireless mesh networks.
Technical details
A vulnerability in the batman-adv module of the Linux kernel stems from the 'batadv_tt_prepare_tvlv_global_data' function in 'net/batman-adv/translation-table.c'. While previous fixes addressed local TT response inconsistencies, the global TT state remained vulnerable to sending empty VLAN responses. This inconsistency can trigger TT request storms across the mesh network. An attacker on an adjacent network could potentially exploit this to cause network instability. The fix ensures that VLANs with no entries are skipped and the TVLV length is correctly recalculated.
Affected products
- Linux Linux Kernel 3.13 to 6.1.176, 5.15.210, 5.10.259, 6.6.x, 6.10.x, 6.11.x, 6.12.x, 6.13.x, 6.14.x, 6.15.x
Timeline
- 2026-05-29: other: Patch authored by Sven Eckelmann
- 2026-07-19: disclosed: CVE published to NVD
References
- https://git.kernel.org/stable/c/1f467d9a095211d3f77e8ff1bee90e73ffe01c64
- https://git.kernel.org/stable/c/99f17d1cdb371cbd037975239b321f346d38f6d2
- https://git.kernel.org/stable/c/9a02c8fc963ddeecb5d8788be0740c1869fc54b7
- https://git.kernel.org/stable/c/ab26e346322648f5c39de017d9723c9256284fce
- https://git.kernel.org/stable/c/b93ca6012712ecab2b551e120d7c95038d6a89e5
- https://git.kernel.org/stable/c/cfb30645280a2131e46cbd1b9a38cfd3ff893f12
- https://git.kernel.org/stable/c/ea4f757641430bcc8322772e161453c4db5ecb64