Executive brief
A vulnerability was identified in the Linux kernel's batman-adv networking module, which is used for managing mesh networks. The issue occurs when the system attempts to clean up old network gateway entries, potentially leading to a system crash or memory corruption because background tasks might still be trying to access that memory. This could impact the stability and availability of devices using this specific networking protocol.
Technical details
A vulnerability in batadv_bla_purge_backbone_gw() in the batman-adv module of the Linux kernel arises from a race condition during the removal of stale backbone gateway entries. The function failed to properly synchronize with report_work items; if a worker was running or pending during a purge, it could attempt to access memory (such as bat_priv) after it had been freed. The root cause was the invocation of cleanup routines within a spinlock-protected region where sleeping (required for cancel_work_sync) is not permitted. The fix restructures the purging loop to release the spinlock before synchronizing and canceling pending work, ensuring memory is not accessed post-deallocation.
Affected products
- Linux Linux Kernel 23721387c409 to 0459430add32ea41f3e2ef9351610e6d33627a6b
Timeline
- 2026-05-10: patched: Initial patch authored by Sven Eckelmann
- 2026-07-24: disclosed: CVE published in NVD dataset
References
- https://git.kernel.org/stable/c/0459430add32ea41f3e2ef9351610e6d33627a6b
- https://git.kernel.org/stable/c/3423a45e5c3d3c5129f88143a9a969787d7d5a0a
- https://git.kernel.org/stable/c/48663158222b3b7f6ee6791a67d512ede7fc94bb
- https://git.kernel.org/stable/c/95a7034661274cf5985708bd2f6d86ee46f88fa9
- https://git.kernel.org/stable/c/c6de1a5a9c406e30b91f1515a6ce05cc84023baa
- https://git.kernel.org/stable/c/ce2c0ee4d76d5ee4b391fe0e31334361e25030ec
- https://git.kernel.org/stable/c/eeddd7bab3d59c1e98642a204141f8c5d6194707