CVE-2026-46233: Linux Kernel Batman-adv Null Pointer Dereference Denial of Service

Technical summary

CVE-2026-46233 is a null pointer dereference vulnerability in batadv_bla_purge_claims() within the Linux kernel's batman-adv module. The function traverses a hash list of claims using only RCU read-side locking, but does not account for concurrent batadv_claim_put() operations that may release and free claims in parallel. When batadv_claim_release() sets backbone_gw to NULL before initiating the delayed RCU kfree, a subsequent call to batadv_bla_claim_get_backbone_gw() from the purge routine attempts to dereference a null pointer. The fix restricts purging to claims with valid reference counts, deferring the cleanup of already-released claims to their existing lifecycle management.

Business impact

For organizations running Linux systems with batman-adv enabled—particularly mesh networking deployments or network bridging configurations—this vulnerability introduces an availability risk. A local attacker can trigger kernel panics or system crashes by forcing claim cleanup operations, disrupting service availability. While not remotely exploitable, the impact is significant in environments where batman-adv is used for bridge loop prevention in multi-node mesh networks or in containerized environments where local privilege escalal could occur.

Affected systems

The Linux kernel is affected, specifically versions that include the batman-adv module with active BLA (bridge loop avoidance) functionality. Any system running batman-adv for network bridging or mesh networking is potentially vulnerable. This includes embedded systems, network appliances, and specialized routing/bridging deployments. Standard desktop and server deployments without batman-adv are not affected.

Exploitability

Exploitability requires local access and the ability to trigger RCU grace period conditions that expose the race condition between claim purging and claim release. An attacker needs to influence the timing of network topology changes or claim lifecycle events to reliably trigger the null pointer dereference. This is not a remote vulnerability, and the attack surface is limited to systems with batman-adv enabled and local user access. The CVSS score of 5.5 reflects the local-only nature and the requirement for precise race condition triggering.

Remediation

Apply kernel patches that add reference count validation to batadv_bla_purge_claims() to ensure only claims with valid references are purged. The vendor fix modifies the purge logic to skip claims that are already in the process of being released, preventing the null pointer dereference. System administrators should upgrade to the patched kernel version provided by their Linux distribution.

Patch guidance

Coordinate with your Linux vendor or distribution maintainer to obtain the patched kernel version. Verify against the official vendor advisory for your specific distribution (Red Hat, Ubuntu, Debian, SUSE, etc.) to identify the exact version that includes this fix. Batman-adv users should prioritize patching, particularly in production mesh networking environments. Standard practice involves scheduling a maintenance window for kernel updates, as this typically requires a system reboot.

Detection guidance

Monitor kernel logs for null pointer dereference panics or oops messages originating from batadv_bla_purge_claims() or related BLA functions. Systems may exhibit sudden crashes or resets when claim purging occurs during network topology transitions. In environments with persistent logging, correlate crashes with batman-adv claim activity. Post-compromise, forensic analysis of kernel crash dumps can confirm whether CVE-2026-46233 was the root cause, though the vulnerability itself does not leave persistent artifacts.

Why prioritize this

While the CVSS score is moderate (5.5), prioritization should reflect the specific deployment context. Organizations using batman-adv for critical mesh networking, bridge loop avoidance, or redundant network topologies should treat this as high priority due to availability impact. Organizations without batman-adv enabled can defer patching to standard update cycles. The local-only attack vector reduces urgency for systems with strict access controls, but the ease of triggering (once access is gained) warrants timely remediation in shared or multi-tenant environments.

Risk score, explained

The CVSS v3.1 score of 5.5 (MEDIUM) reflects: local-only attack vector (AV:L), low attack complexity (AC:L), low privilege requirement (PR:L), no user interaction needed (UI:N), unchanged scope (S:U), no confidentiality or integrity impact (C:N/I:N), and high availability impact (A:H). The moderate score accounts for the requirement of local access and the specific technical conditions needed to trigger the race condition, offset by the severe availability consequences when successfully exploited.

Frequently asked questions