CVE-2026-46231: Linux batman-adv Memory Leak in Claim Hash Insertion

Technical summary

CVE-2026-46231 is a resource leak vulnerability in the batman-adv Broadcast, Unknown, Directed (B.U.D.) Local Area Network (BLAN) module within the Linux kernel. The vulnerability exists in the batadv_bla_add_claim() function, which manages claim insertions into a hash table. When hash insertion fails—typically due to memory allocation failure or table exhaustion—the function returns an error without decrementing the reference count on the backbone_gw (backbone gateway) object. This omission violates reference-counting discipline and leaves the backbone_gw structure allocated in memory. The fix introduces a call to batadv_backbone_gw_put() on the error path to properly release the reference and allow garbage collection of the object.

Business impact

On systems that use batman-adv for mesh networking, this vulnerability creates a slow-burn denial of service vector. Repeated failed claim insertions accumulate leaked backbone gateway objects, consuming kernel memory over time. On memory-constrained devices—such as embedded systems, IoT gateways, or containerized environments—this can lead to eventual out-of-memory conditions, system crashes, or service interruptions. For organizations deploying batman-adv in mesh networks or wireless mesh backhauls, the vulnerability increases operational risk and may require unplanned reboots or service restarts to recover from accumulated memory exhaustion.

Affected systems

The vulnerability affects Linux kernels that include the batman-adv module. Affected versions are those shipped before the fix was applied; the exact range depends on kernel release cycles and distribution backporting practices. Batman-adv is used in specialized mesh networking deployments, including some IoT platforms, wireless mesh networks, and ad-hoc networking scenarios. Standard server and desktop Linux distributions ship the module but may not actively use it unless explicitly configured for mesh networking. Systems should verify their kernel version and batman-adv enablement status against vendor advisories.

Exploitability

Exploitation requires local access and the ability to trigger repeated failed claim hash insertions within batman-adv. This is not a remote code execution vulnerability and does not grant elevated privileges. An unprivileged local user or application operating within a batman-adv mesh network could potentially trigger the leak through malformed network traffic or by exhausting hash table capacity. However, practical exploitation is constrained by the need to repeatedly trigger failure conditions. The CVSS score of 5.5 (Medium) reflects local-only access requirements and availability impact (memory exhaustion) rather than confidentiality or integrity breaches.

Remediation

Apply a kernel update that includes the fix to batadv_bla_add_claim(). The patch adds an explicit batadv_backbone_gw_put() call in the error path to release the backbone gateway reference on failed hash insertion. Organizations should coordinate with their Linux distribution vendor to obtain a patched kernel version that addresses this issue. For systems unable to update immediately, disabling batman-adv if not actively used eliminates exposure; however, this is impractical for systems that depend on mesh networking.

Patch guidance

Consult your Linux distribution's security advisory for the availability and version number of patched kernels. Ubuntu, Debian, Red Hat, SUSE, and other major distributions will release kernel updates addressing this vulnerability in their respective cadences. Apply updates to your kernel package and reboot systems running batman-adv. Verify the fix by confirming the presence of the batadv_backbone_gw_put() error-path call in your kernel source or by checking the kernel's changelog against the CVE identifier. Test in a non-production environment first to confirm compatibility with local mesh networking configurations.

Detection guidance

Monitor kernel memory usage trends on systems running batman-adv, particularly on memory-constrained devices. Watch for sustained increases in kernel memory (kmem) or unreclaimable memory that correlate with batman-adv activity. Enable kernel memory accounting and auditing to track backbone_gw object allocations and deallocations. Use tools such as kmemleak or systemtap to detect unreleased reference counts on batman-adv structures. Log batman-adv module statistics and watch for anomalies in claim table insertions or failures. Implement alerts for out-of-memory conditions or kernel panic events on affected systems.

Why prioritize this

Although the CVSS score is Medium (5.5), prioritization depends on deployment context. Systems actively using batman-adv for critical mesh networking should prioritize patching to avoid cumulative memory exhaustion and service degradation. Embedded and IoT deployments with limited memory are at higher risk from this leak. Standard Linux servers and desktops with batman-adv disabled or unused can deprioritize but should still apply updates during routine maintenance cycles. Organizations operating mesh networks should treat this as moderate-to-high priority within their own infrastructure.

Risk score, explained

The CVSS 3.1 score of 5.5 (Medium) reflects: Attack Vector Local (cannot be exploited remotely), Attack Complexity Low (no unusual conditions required), Privileges Required Low (any local user can trigger repeated network operations), User Interaction None (no user action needed), Scope Unchanged (impact confined to the affected system), Confidentiality None (no secrets exposed), Integrity None (no data corrupted), Availability High (memory exhaustion can crash or degrade the system). The Medium severity appropriately captures that this is a local denial-of-service vector with no remote or privilege-escalation component, but poses real risk to availability on affected deployments.

Frequently asked questions