CVE-2026-46212: Linux batman-adv Use-After-Free in BLA Claim Deletion

Technical summary

CVE-2026-46212 is a use-after-free flaw (CWE-416) in batman-adv's bla (Bridge Loop Avoidance) subsystem. The function batadv_bla_del_backbone_claims() removes claims by dropping hash list entries, but the corresponding batadv_claim_put() reference count decrement was being performed before the final access to the claim object completed. If batadv_claim_release() executes during this window, the claim structure is deallocated while still being referenced by the hash list removal operation. This violates object lifetime safety and can corrupt kernel memory or trigger a panic.

Business impact

Systems relying on batman-adv for mesh networking—including edge devices, IoT deployments, and specialized Linux distributions supporting wireless mesh topologies—face potential availability and integrity risks. Depending on placement and privilege context, attackers on the mesh network could trigger kernel crashes, cause denial of service, or potentially escalate privileges. Organizations operating mesh networks or software-defined networking solutions using batman-adv should treat this as a high-priority stability and security issue.

Affected systems

The Linux kernel is affected across multiple versions where batman-adv is enabled. The vulnerability resides in the batman-adv kernel module used for mesh network routing. Systems specifically impacted are those with batman-adv compiled into the kernel or loaded as a module, particularly edge devices, wireless mesh deployments, and custom Linux distributions. Standard enterprise Linux systems without batman-adv enabled are not affected.

Exploitability

The vulnerability requires an attacker to be on the mesh network (AV:A per CVSS) but does not require privilege or user interaction. An attacker with network adjacency to a batman-adv mesh can trigger the race condition by timing backbone claim deletions, causing the use-after-free condition to manifest. The low complexity and no-privilege requirement (AC:L/PR:N) mean exploitation is practical once an attacker gains mesh network presence, though the exact reproducibility depends on kernel timing and memory layout.

Remediation

Apply the Linux kernel patch that reorders the claim reference drop to occur after all accesses to the claim object have completed. This typically involves moving the batadv_claim_put() call to the end of the batadv_bla_del_backbone_claims() function or restructuring the loop to avoid premature deallocation. Verify the specific patch version against the vendor advisory for your Linux distribution and kernel branch.

Patch guidance

Monitor your Linux distribution's security advisories for kernel updates addressing this vulnerability. If your system runs batman-adv (verify via `lsmod | grep batman` on deployed systems), prioritize applying kernel updates once available from your vendor. Backports to stable kernel branches and long-term support releases should be expected. Test patches in a non-production mesh environment first to ensure compatibility with your specific batman-adv topology and configuration.

Detection guidance

Monitor kernel logs for batman-adv related panics or oops messages, particularly those involving claim or backbone operations. Kernel Address Sanitizer (KASAN) builds will detect the use-after-free more reliably in development/test environments. For production systems, watch for unexpected kernel crashes or system hangs when batman-adv topology changes occur (nodes joining/leaving mesh). Intrusion detection systems should flag suspicious mesh network traffic patterns designed to trigger rapid claim churn.

Why prioritize this

With a CVSS 3.1 score of 8.8 (HIGH severity) and direct impact on kernel integrity via use-after-free, this vulnerability merits immediate attention for any organization using batman-adv in production. The network-adjacent attack vector limits exposure compared to remote code execution, but the high impact on confidentiality, integrity, and availability justifies rapid remediation once patches are available. Prioritize systems in security-sensitive mesh deployments (e.g., critical edge infrastructure).

Risk score, explained

The 8.8 CVSS score reflects high impact across all three security dimensions (C:H/I:H/A:H) balanced against the network-adjacent attack requirement (AV:A). The absence from CISA KEV indicates limited weaponized exploits at time of publication, but the technical simplicity of triggering a use-after-free race condition means exploit code development is straightforward once researchers have access to vulnerable systems. Organizations should not rely on KEV status as a deferral justification.

Frequently asked questions