CVE-2026-52916: Linux batman-adv Stack Exhaustion Denial of Service

Technical summary

CVE-2026-52916 is a stack exhaustion vulnerability in the batman-adv fragmentation handler (batadv_frag_skb_buffer()). The flaw occurs because the defragmentation process reassembles BATADV_UNICAST_FRAG packets and then re-invokes batadv_batman_skb_recv() to process the payload without validating that the reassembled packet is not itself a fragmented packet. An attacker can craft nested fragmented packets (BATADV_UNICAST_FRAG containing a BATADV_UNICAST_FRAG payload) that cause unbounded recursion through the receive handler, exhausting kernel stack space. The fix introduces a validation check to discard packets that remain fragmented after the defragmentation process, preventing recursive processing of fragments-within-fragments.

Business impact

This vulnerability enables local denial of service attacks against systems using batman-adv, a mesh networking protocol commonly deployed in decentralized or ad-hoc network environments. An attacker with local network access can crash affected nodes, disrupting mesh network availability and potentially affecting services reliant on those nodes. In production mesh networks, widespread exploitation could fragment connectivity across the mesh. The attack requires local access, limiting exposure to systems where threat actors already have network presence, but the simplicity of exploitation (sending crafted packets) makes it a credible threat within compromised network segments.

Affected systems

The Linux kernel is affected across versions prior to the security patch. The vulnerability impacts any system running batman-adv, a kernel module typically enabled on Linux systems configured for mesh networking, IoT deployments, or decentralized network applications. Desktop and server systems with standard configurations are generally not affected unless batman-adv is explicitly enabled. Embedded Linux systems, particularly those in IoT or mesh network deployments, represent the highest-risk population.

Exploitability

The vulnerability is moderately exploitable. It requires local network access (AV:L) and authentication at a user privilege level or higher (PR:L), making it unsuitable for remote exploitation but practical for attackers already on a local network segment or with user-level shell access. No interaction (UI:N) is needed; sending the malicious packet is sufficient. Exploit complexity is low (AC:L)—the attack involves crafting network packets without race conditions or other complications. Public PoC code would likely be straightforward, though none is known to be in circulation at this time.

Remediation

Apply a Linux kernel security update that includes the patch to disallow reassembled BATADV_UNICAST_FRAG packets. The fix adds a validation step in the defragmentation handler to detect and reject packets that remain fragmented after reassembly, eliminating the recursive processing path. Kernel maintainers should verify the patch is included in stable and long-term support branches. Until patched, restrict batman-adv usage to trusted network environments and monitor for unexpected kernel crashes on affected nodes.

Patch guidance

Monitor your Linux distribution's security bulletins for kernel updates addressing CVE-2026-52916. The patch should be incorporated into the batman-adv module source or as a standalone kernel patch. Verify patch inclusion in the release notes, as not all distributions backport fixes to all supported kernel versions. For systems running batman-adv, prioritize testing and deployment of patched kernels in non-production environments first to ensure mesh network stability. If kernel update timelines exceed your risk tolerance, consider temporarily disabling batman-adv if operationally feasible.

Detection guidance

Monitor kernel logs for stack overflow messages (e.g., 'kernel stack overflow' or panic logs with batman-adv stack traces) on systems with batman-adv enabled. Network intrusion detection systems can flag unusual patterns of BATADV_UNICAST_FRAG packets arriving from the same source in rapid succession, though crafting deeply nested packets may not generate distinctive traffic signatures. Consider logging batman-adv module events if verbose logging is available. Host-based detection focusing on unexpected kernel panics or restarts on batman-adv-enabled nodes is more reliable than network-level detection.

Why prioritize this

Assign this vulnerability medium priority in most environments due to its local-access requirement, but escalate to high in mesh networking and IoT deployments where batman-adv is actively used. The availability impact (complete kernel crash) and low complexity of exploitation warrant timely patching within 30–60 days. For organizations without batman-adv deployments, this vulnerability poses minimal risk and can be deferred to routine patching cycles.

Risk score, explained

The CVSS v3.1 score of 5.5 (MEDIUM) reflects the vulnerability's high impact on availability (A:H) balanced against its constraints: local attack vector and low privilege requirements. The lack of confidentiality or integrity impact (C:N/I:N) prevents a higher score, and the requirement for user-level privileges (PR:L) limits the attack surface. In the context of targeted mesh networks or systems where local attackers are a realistic threat, the practical risk may exceed this baseline score; conversely, standard server deployments without batman-adv see negligible risk.

Frequently asked questions