CVE-2026-52913: Linux Kernel batman-adv NULL Pointer DoS Vulnerability

Technical summary

CVE-2026-52913 is a NULL pointer dereference vulnerability in the batman-adv v15 implementation within the Linux kernel. When a batadv_hard_iface is disabled, its mesh_iface pointer is nullified; however, batadv_v_ogm_send_meshif() continues to dispatch Optimized Link State Routing v2 (OGMv2) packets through batadv_v_ogm_queue_on_if(). This function unconditionally dereferences the now-NULL mesh_iface pointer via netdev_priv() to retrieve the batadv_priv structure, triggering a kernel panic. The root cause is insufficient validation that the mesh_iface used during OGM transmission matches the interface context at dispatch time. The fix requires batadv_v_ogm_queue_on_if() to verify mesh_iface consistency before proceeding.

Business impact

Organizations running batman-adv for mesh networking (common in community networks, edge computing deployments, and some embedded systems) face availability disruption. A local attacker can remotely trigger kernel panics, forcing system restarts and interrupting services. For mission-critical infrastructure relying on batman-adv for redundancy or network automation, this becomes a significant operational risk. Recovery requires manual intervention or orchestrated restarts, adding operational overhead.

Affected systems

The Linux kernel across multiple versions that include the batman-adv module. Exposure depends on whether batman-adv is compiled into the kernel or available as a module, and whether mesh networking is actively configured. Systems using batman-adv for wireless mesh networks, edge gateways, or network-attached appliances are directly affected. Default Linux distributions may include batman-adv but typically do not enable it unless explicitly configured by administrators.

Exploitability

Exploitability is straightforward for local attackers (CVSS vector AV:L). No special privileges are required beyond standard user-level access (PR:L), and no user interaction is necessary. An attacker can reliably trigger the crash by causing network interface state transitions on a system with batman-adv enabled and mesh networking active. The vulnerability does not enable privilege escalation or data theft, but denial of service is trivial to achieve.

Remediation

Apply the Linux kernel patch that adds a mesh_iface consistency check within batadv_v_ogm_queue_on_if(). This ensures OGM packets are only queued on interfaces that remain associated with their original mesh context. Verify the patch version against the kernel security advisory, as fixes may be backported across multiple kernel branches. Alternatively, disable batman-adv if mesh networking is not required, or restrict local user access on systems where batman-adv is active.

Patch guidance

Monitor linux.org security advisories for kernel releases incorporating the batman-adv v15 fix. The vulnerability affects the batman-adv subsystem specifically; patch availability will depend on your kernel branch and distribution. Check your vendor's security bulletins—Red Hat, Debian, Ubuntu, and other major distributions will publish guidance once patches are available. Apply patches during your standard kernel update cycle; this does not require emergency action unless batman-adv mesh networking is critical to your operations.

Detection guidance

Monitor system logs for kernel NULL pointer dereference panics mentioning batman-adv, batadv_v_ogm_send_meshif, or batadv_v_ogm_queue_on_if in the call stack. Kernel crash dumps (vmcore files) will show the dereferenced NULL pointer in netdev_priv() calls. On systems with batman-adv enabled, correlate crashes with interface state changes (ifdown, ifup, or dynamic interface removal). Intrusion detection signatures should flag repeated kernel panic patterns on systems where batman-adv mesh is active.

Why prioritize this

Although the CVSS score of 5.5 indicates medium severity, prioritization should account for operational context. Systems without batman-adv mesh networking enabled face no exposure and require no action. For organizations actively deploying batman-adv (wireless mesh providers, edge computing platforms, community networks), this becomes a high-priority availability risk despite the low CVSS score. Triage by assessing batman-adv deployment scope within your infrastructure.

Risk score, explained

The CVSS 5.5 MEDIUM rating reflects local-only attack surface (AV:L), low privilege requirements (PR:L), and impact limited to availability (A:H with C:N, I:N). No network-based attack path exists, no privilege escalation occurs, and no confidentiality or integrity loss is possible. The score appropriately reflects the denial-of-service nature of the vulnerability without overstating risk for systems where batman-adv is not deployed.

Frequently asked questions