CVE-2026-46208: Linux batman-adv TP Meter Race Condition During Mesh Teardown

Technical summary

The batman-adv module's TP meter (throughput measurement) implementation maintains active session state in bat_priv->tp_list that persists after the netlink request completes. When batadv_mesh_free() executes during mesh teardown, it does not drain these sessions before proceeding with mesh deallocation. A sender thread with pending operations or an incoming TP meter packet can then operate on freed or partially-freed mesh state, creating a use-after-free or race condition. The patch synchronizes TP meter lifecycle with mesh lifetime by explicitly stopping all active sessions during mesh free and blocking until sender threads have exited.

Business impact

For organizations running mesh networking deployments on Linux (edge computing, autonomous systems, sensor networks, military/tactical communications), this vulnerability poses a stability and confidentiality risk. Repeated mesh teardown cycles could trigger kernel crashes, data corruption, or privilege escalation from a local attacker. In production environments where mesh interfaces are dynamically reconfigured or where untrusted local users can trigger network resets, the impact escalates significantly. Affected systems may exhibit intermittent failures, corrupted routing state, or silent data loss.

Affected systems

Linux kernel versions that include the batman-adv mesh networking driver are affected. This is typically enabled in custom or embedded Linux builds, particularly those used in IoT, edge computing, drone systems, or tactical mesh networks. Standard desktop and server distributions may not enable batman-adv by default, reducing exposure in typical enterprise environments. Systems with CONFIG_BATMAN_ADV enabled are at risk.

Exploitability

Exploitation requires local access (AV:L) and user-level privileges (PR:L). An attacker cannot trigger this remotely, and must either be a logged-in user or have shell access to the target system. The attack does not require user interaction; simply removing the mesh interface while a TP meter session is active may trigger the race condition. The technical bar for exploitation is moderate—forcing the race condition reliably may require specific timing, but the underlying flaw is deterministic once triggered.

Remediation

Apply a kernel patch that drains all TP meter sessions during batadv_mesh_free() and synchronizes sender thread exit before continuing with mesh teardown. Verify the patch commit against the Linux kernel's batman-adv subsystem repository. Recompile and test the patched kernel in a non-production environment first, particularly if batman-adv is critical to your deployment. For systems where batman-adv is not required, disabling CONFIG_BATMAN_ADV eliminates the vulnerability entirely.

Patch guidance

Monitor the Linux kernel maintainers' updates for the batman-adv driver. Patches addressing this issue should be included in stable kernel releases following the initial upstream merge. Verify patch status in your distribution's kernel advisory pages (Red Hat, Canonical, SUSE, etc.). If you maintain a custom kernel build, cherry-pick the upstream batman-adv fix from Linus Torvalds' repository or the Linux stable tree. Test mesh interface creation, TP meter operation, and mesh teardown cycles before deploying to production.

Detection guidance

Monitor kernel logs (dmesg) for use-after-free warnings, NULL pointer dereferences, or 'BUG: unable to handle page fault' messages originating from batman-adv code paths during mesh teardown. Enable CONFIG_DEBUG_KMEMLEAK to detect memory leaks in batman-adv session structures. If mesh interface removal is followed by oops or soft lockup logs, the vulnerability may be triggering. Trace TP meter session lifecycle with ftrace or eBPF to detect sessions active during mesh_free() execution.

Why prioritize this

This vulnerability merits prompt patching in any environment where batman-adv is active. Although it requires local access, it can result in kernel crashes (denial of service) or privilege escalation, and the race condition is trivially triggered by normal mesh teardown operations. The CVSS 7.8 HIGH severity reflects the high impact (confidentiality, integrity, availability) despite local-only access. Organizations should prioritize kernel updates within 2–4 weeks, sooner if batman-adv is mission-critical.

Risk score, explained

The CVSS 3.1 score of 7.8 (HIGH) reflects: (1) high impact across confidentiality, integrity, and availability; (2) local attack vector, limiting scope but not eliminating risk in multi-user or edge environments; (3) low attack complexity, as normal mesh teardown can trigger the flaw; (4) low privileges required, accessible to any local user. The score is not critical because remote exploitation is impossible, but the combination of crash/corruption risk and ease of triggering warrants urgent remediation.

Frequently asked questions