Executive brief
The Linux kernel's batman-adv mesh networking module contains a use-after-free vulnerability in its packet fragment reassembly logic. When a network interface is removed while fragments are being reassembled, the kernel can attempt to access freed memory through stale device references, potentially leading to system crashes or privilege escalation on systems running batman-adv.
Technical details
The vulnerability exists in the batman-adv fragment reassembly code within net/batman-adv/main.c. When reassembling fragmented packets, the code reuses the skb (socket buffer) metadata from the highest-numbered fragment. If the hard interface on which that fragment was received is deleted before reassembly completes, the merged packet re-enters the receive path with stale skb->dev and skb_iif fields pointing to a freed net_device structure. The batadv_batman_skb_recv() function then passes this merged packet through normal receive handlers (DAT and bridge loop avoidance), which dereference the freed device pointer when extracting ARP header information. The fix refreshes skb->dev and skb->skb_iif metadata from the current receive device before running packet handlers. The vulnerability affects all kernel versions with batman-adv support; patches were released in stable kernels starting September 2026.
Affected products
- Linux Linux Kernel All versions with batman-adv support (included in stable trees from 2.6.11 onwards)
Timeline
- 2026-09-16: disclosed
- 2026-09-11: patched: Patches merged in stable kernel trees