Executive brief
The Batman Advanced mesh networking module in the Linux kernel failed to properly linearize network packet buffers during multicast packet generation, causing a fatal kernel panic (BUG) when certain code paths were executed. This denial-of-service condition could be triggered locally, disrupting systems relying on mesh networking for connectivity or data relay.
Technical details
The vulnerability exists in the batman-adv multicast forwarding logic where batadv_mcast_forw_packet() and batadv_mcast_forw_scrape() functions require linearized socket buffers (SKBs) but were called without proper linearization by batadv_mcast_forw_mcsend(). When batadv_mcast_forw_scrape() was reached via the batadv_mcast_forw_mode() selection path, it triggered an SKB_LINEAR_ASSERT() assertion that caused a fatal BUG(). The fix adds skb_linearize() in batadv_mcast_forw_expand_head() before the scrape function can be called, ensuring buffers are properly linearized. Attack vector requires local network access or ability to trigger multicast packet generation on an affected system.
Affected products
- Linux Linux kernel batman-adv module (affected versions not explicitly specified in advisory)
Timeline
- 2026-09-16: disclosed: CVE-2026-89950 published
- 2026-07-09: patched: Upstream fix commit 6a30a59e2660afd03c975f1b8eae6a2301161197
- 2026-09-11: patched: Stable tree fix commit 2879177539e3ece483a8e5406970373698e9a6c5