Executive brief
The Linux kernel's batman-adv (Batman Advanced) networking module contains a bug in its bridge loop avoidance (BLA) code that prevents proper cleanup of network claims when a mesh interface is deleted. This causes memory to be incorrectly retained and can prevent proper network teardown. The issue affects systems using batman-adv mesh networking, potentially impacting availability of mesh network operations.
Technical details
The vulnerability is a resource cleanup bug in the batman-adv bridge loop avoidance implementation. When a mesh interface is deleted, the batadv_bla_free() function sets bat_priv->bla.claim_hash to NULL before calling batadv_bla_del_backbone_claims(), which prevents the latter function from executing and properly freeing BLA claims. Additionally, the batadv_handle_unclaim() function could fail when searching for backbone gateways due to rehashing issues in batadv_bla_update_orig_address(), causing claim deletion to fail. The fix removes the unnecessary backbone_gw lookup in batadv_handle_unclaim() since all required information is already provided by the caller. This is a local denial-of-service / resource leak issue requiring no special privileges or network access—it triggers on normal interface deletion operations. A patch has been merged into the Linux stable kernel series.
Affected products
- Linux Linux kernel multiple stable versions (2.6.x through 7.x)
Timeline
- 2026-09-16: disclosed
- 2026-09-14: patched: Fix merged into stable kernel trees