Executive brief
A vulnerability was identified in the Linux kernel's batman-adv networking module, which is used for managing mesh networks. A race condition in the throughput meter component could allow a system timer to be improperly restarted after it was supposed to be shut down. This could lead to unpredictable system behavior or memory issues when the system attempts to access data that has already been cleaned up.
Technical details
A race condition exists in net/batman-adv/tp_meter.c within the Linux kernel. The batadv_tp_sender_cleanup() function previously used a non-atomic double-deletion sequence (timer_delete_sync followed by timer_delete) to stop the sender timer. A race condition occurs if batadv_tp_recv_ack() triggers batadv_tp_reset_sender_timer() between these calls; the timer may be re-armed even though the underlying reference is being destroyed. This is resolved by using timer_shutdown_sync(), which permanently disarms the timer and prevents subsequent re-arming. The issue affects the throughput meter (tp_meter) component of the B.A.T.M.A.N. Advanced mesh routing protocol.
Affected products
- Linux Linux Kernel 33a3bb4a3345 to 00bf4bb9947b
Timeline
- 2026-05-28: patched: Initial patch authored by Sven Eckelmann
- 2026-07-19: disclosed: CVE published
References
- https://git.kernel.org/stable/c/00bf4bb9947b1190a8be8d9b6a1bcbfa3707785c
- https://git.kernel.org/stable/c/5bc2d50fb66b46f86543d5153a188eb1486d0b6e
- https://git.kernel.org/stable/c/74a76634055462833446684fd526d73c290ea43a
- https://git.kernel.org/stable/c/770bf0a35f0620b526fd4193889d1e77084e4c43
- https://git.kernel.org/stable/c/933880a8bc9b4042223a79255c0b1021cdc36991
- https://git.kernel.org/stable/c/d5487249a81ea658717614009c8f46acc5b7101a
- https://git.kernel.org/stable/c/f86b20ec8d17d77bddc02c5c86cfa2389d84ecff