Executive brief
The Batman Advanced (batman-adv) kernel module, used in mesh networking to route packets efficiently, contains a race condition that corrupts checksums when multiple processors simultaneously add and modify network claims. This corruption persists and cannot be self-corrected, leading to incorrect packet routing and potential network instability or unavailability.
Technical details
A race condition exists in batadv_bla_add_claim() where the "new claim" code path running on one CPU can execute in parallel with the "change backbone" code path on another CPU, causing the backbone CRC to be corrupted. The vulnerability occurs because the backbone_gw pointer of a claim can be changed twice—once by CPU1 during an ownership transfer (updating the CRC appropriately) and again by CPU0 during the new claim creation (without updating the CRC), leaving both the old and new backbone CRCs in an invalid state. The CRC is never recomputed from stored claims, and the corruption cannot be recovered via sync operations for local backbone claims. The fix separates the "new claim" and "update existing claim" logic into independent code paths to prevent the parallel execution race condition.
Affected products
- Linux Linux kernel before resolution of CVE-2026-93203
Timeline
- 2026-09-17: disclosed
- 2026-09-17: advisory: CVE-2026-93203 published