CVE-2026-46238: Linux Kernel B.A.T.M.A.N. Use-After-Free Vulnerability – CVSS 8.8 HIGH

Technical summary

CVE-2026-46238 is a use-after-free vulnerability in the B.A.T.M.A.N. IV routing daemon within the Linux kernel. The BAT IV implementation stores an originator pointer in neighbor node structures derived from a temporary lookup operation. This pointer is not properly owned or reference-counted by the neighbor node, making it vulnerable to invalidation during purge cycles. When the routing logic later attempts to use this cached originator pointer without validation, it may reference freed memory. The fix resolves the issue by eliminating the auxiliary pointer cache and instead performing on-demand lookups from the stored neighbor address, ensuring the pointer lifecycle is properly managed.

Business impact

Systems running mesh networking deployments—particularly edge devices, IoT gateways, or community network infrastructure using B.A.T.M.A.N. routing—face denial-of-service and potential remote code execution risks from local network attackers. Affected organizations should assess whether their infrastructure relies on kernel-level B.A.T.M.A.N. routing and prioritize patching accordingly. The local attack vector limits exposure in typical data center environments but poses material risk in wireless mesh, edge computing, and distributed network topologies.

Affected systems

Linux kernel versions incorporating the vulnerable B.A.T.M.A.N. IV routing module are affected. The vulnerability is present in systems where B.A.T.M.A.N. advanced networking is compiled into or loaded as a module. Verify your kernel version and B.A.T.M.A.N. configuration by checking kernel logs and network module status; consult your Linux distribution's advisory for specific affected version ranges and patch availability.

Exploitability

The vulnerability requires network-adjacent access (AV:A) and no special privileges or user interaction. An attacker positioned on the same local network segment can craft malicious routing traffic to trigger the use-after-free condition. While the attack surface is restricted to local networks, the ease of exploitation (low complexity, no authentication required) and the severity of potential impact (confidentiality, integrity, availability all compromised) make this a practical threat within mesh networking environments.

Remediation

Apply the kernel patch that removes the unowned originator pointer cache and replaces it with on-demand lookups from neighbor addresses. Linux distributions will release kernel updates addressing this issue; obtain patches through your distribution's security advisory channels. Verify patch application by confirming kernel version and rebuilding any custom kernel configurations that include B.A.T.M.A.N. support.

Patch guidance

Monitor your Linux distribution's security advisories for kernel updates that address CVE-2026-46238. Once available, prioritize patching for systems actively running B.A.T.M.A.N. mesh networking. Test patches in non-production environments first, particularly for critical mesh network infrastructure. Patch deployment should follow your organization's change management process; kernel updates typically require system restart. Verify the patched kernel is running post-reboot using `uname -r` and confirm B.A.T.M.A.N. module functionality through routing table inspection.

Detection guidance

Monitor kernel logs for memory corruption errors, page faults, or segmentation faults correlated with B.A.T.M.A.N. routing activity. Systems using kernel debugging facilities (CONFIG_DEBUG_PAGEALLOC, CONFIG_KASAN) may detect use-after-free access patterns earlier. Network anomalies in mesh topologies—unexpected routing changes, neighbor discovery failures, or sudden peer disconnections—may indicate exploitation attempts. Review kernel version and B.A.T.M.A.N. module status across your infrastructure to identify unpatched systems.

Why prioritize this

This vulnerability merits high priority due to its CVSS 8.8 severity score, practical exploitability within local network segments, and potential for both denial-of-service and code execution. While the attack surface is limited to network-adjacent threats, mesh networking and edge infrastructure deployments have become increasingly prevalent. Organizations relying on B.A.T.M.A.N. for critical connectivity should treat this as urgent.

Risk score, explained

The CVSS 3.1 score of 8.8 (HIGH) reflects the confluence of high-impact outcomes (complete confidentiality, integrity, and availability compromise), low attack complexity, absence of privilege or user interaction requirements, and restricted but practical attack vector (adjacent network). The score appropriately elevates the threat beyond moderate due to the use-after-free's potential for kernel privilege escalation within affected mesh topologies.

Frequently asked questions