Executive brief
The batman-adv (Better Approach To Mobile Ad-hoc Networking) kernel module manages mesh network routing and address resolution. A race condition in the Distributed ARP Table (DAT) component could allow concurrent readers to observe partially-updated MAC addresses, potentially leading to corrupted network traffic or ARP cache poisoning.
Technical details
The vulnerability is a data race in batadv_dat_entry_add() where MAC addresses are updated using a non-atomic byte-copy operation (ether_addr_copy). A parallel reader thread accessing the same MAC address field concurrently may observe an inconsistent state—seeing only part of the update. This can result in transmission of corrupted MAC addresses over the network or injection of poisoned ARP responses. The fix replaces the non-atomic copy with atomic64_t operations, ensuring readers see either the complete old address or complete new address, never a mixture. The vulnerability affects all kernel versions with batman-adv DAT support. Patches have been issued and backported across stable kernel series.
Affected products
- Linux Linux kernel All versions with batman-adv Distributed ARP Table support
Timeline
- 2026-09-17: disclosed: Published on NVD
- 2026-09-14: patched: Fix backported to stable kernel series by Greg Kroah-Hartman