Executive brief
A vulnerability was identified in the Linux kernel's batman-adv module, which is used for managing mobile ad-hoc networks. Under specific conditions when a network interface is disconnected, the system could attempt to access a non-existent memory address, leading to a system crash (kernel panic). This could result in a denial of service for devices relying on this networking protocol.
Technical details
A race condition exists in the batman-adv module's bridge loop avoidance (bla) component. Without the rtnl_lock held, a 'hardif' (hard interface) can be retrieved as the primary interface of a 'meshif' (mesh interface), but may subsequently be decoupled, setting the pointer to the mesh interface to NULL while operations are still in progress. This results in a NULL pointer dereference when the kernel attempts to send an ARP request using the now-NULL mesh interface pointer. The fix involves using READ_ONCE to safely retrieve the interface pointer and performing a NULL check before proceeding. Affected versions range from 3.5 up to various stable branches fixed in June 2026.
Affected products
- Linux Linux Kernel 3.5 to 5.10.259, 5.15.210, 6.1.176, 6.6.33, 6.9.4, 6.10-rc2
Timeline
- 2026-05-29: disclosed: Vulnerability reported and patch authored
- 2026-06-09: patched: Patch committed to stable kernel tree
- 2026-07-19: advisory: CVE published to NVD dataset
References
- https://git.kernel.org/stable/c/0f3ebd7bb417aabc44853cc7c2a184ebb0e05b45
- https://git.kernel.org/stable/c/2a8c9e86529156c62d9187b9ed9454c31665ad33
- https://git.kernel.org/stable/c/4f6266735a0ba6a568b6d4c9fa51c33a5a7f2d70
- https://git.kernel.org/stable/c/53cb3511f6eda37d3bd923545fdba6013b6d7bb7
- https://git.kernel.org/stable/c/555b8d3f5c313d81d46274fd0976352dafc80124
- https://git.kernel.org/stable/c/6921a7683ae9ad0208d829e71f725a9e25ccff49
- https://git.kernel.org/stable/c/efb62458c94db1fe3a287e7e89c31b0cfb03f938