CVE-2026-52919: Linux batman-adv Use-After-Free Privilege Escalation

Technical summary

CVE-2026-52919 is a use-after-free vulnerability in the batman-adv module (kernel/net/batman-adv) caused by improper atomic counter management during shutdown. The batadv_tp_sender_shutdown() function unconditionally decrements the 'sending' atomic counter without checking its current state. When multiple shutdown paths (timeout handler, user cancellation, normal completion) invoke this function concurrently or sequentially, the counter can underflow to negative values. Since the sender kthread interprets any non-zero counter value as an active transmission state, negative values cause the thread to loop indefinitely. When the network interface is subsequently removed, the orphaned kthread continues to reference freed kernel structures, creating a use-after-free condition. The fix employs atomic_xchg() to atomically swap the counter from 1 to 0 in a single operation, ensuring the shutdown logic executes only once regardless of how many code paths attempt to trigger it.

Business impact

This vulnerability enables local privilege escalation on systems running affected Linux kernel versions with batman-adv compiled in. An unprivileged user can trigger the vulnerability through network interface manipulation, leading to kernel memory corruption and potential code execution with kernel privileges. On systems where batman-adv is used (mesh networking deployments, some IoT and edge computing platforms), this creates a critical path to full system compromise. The indefinite kthread loop also causes denial of service by consuming CPU resources and preventing graceful interface shutdown.

Affected systems

The Linux kernel with batman-adv module support is affected. Batman-adv is included in standard kernel builds but is primarily used in mesh networking scenarios, including some embedded distributions and IoT platforms. Systems with batman-adv compiled as a module (most distributions) can mitigate by unloading the module if not needed. The vulnerability affects all kernel versions containing the vulnerable batadv_tp_sender_shutdown() code path; consult kernel changelogs and vendor advisories to determine exact affected version ranges for your distribution.

Exploitability

Local exploitability is straightforward. An unprivileged user can trigger the vulnerability by manipulating batman-adv network interfaces (e.g., via netlink or sysfs interfaces) to cause multiple shutdown paths to execute concurrently. No kernel module reloading or special capabilities are required beyond standard user-level network interface permissions. The race condition is deterministic and reliable. Remote exploitation is not possible; an attacker must have local user access. The CVSS score of 7.8 (High) reflects the high impact (privilege escalation, memory corruption) and low attack complexity, though local access is required.

Remediation

Apply a kernel update containing the fix for CVE-2026-52919. The fix replaces the unconditional atomic_dec() call in batadv_tp_sender_shutdown() with an atomic_xchg() operation that safely transitions the counter from 1 to 0 exactly once. Verify your kernel version and distribution's patch timeline; most major distributions should have backported this fix into their stable branches within weeks of the June 2026 publication date. For systems where batman-adv is not actively used, unloading the module (rmmod batman_adv) immediately eliminates the attack surface.

Patch guidance

Apply the kernel update provided by your distribution's security advisories for CVE-2026-52919. The patch modifies the batman-adv tp_meter shutdown logic to use atomic_xchg() instead of atomic_dec(). Verify the patched kernel includes the fix in batadv_tp_sender_shutdown() and related batadv_tp_send() changes referenced in the commit message. After patching, reboot to load the fixed kernel. No special configuration changes are required. If batman-adv is loaded as a module, you may be able to unload and reload the module without rebooting, but a full reboot is recommended to ensure all affected code paths are replaced.

Detection guidance

Monitor kernel logs for repeated messages related to batman-adv kthread hangs, interface removal delays, or use-after-free warnings (KASAN, if enabled). Check for zombie kthreads named 'bat_*' in 'ps' or '/proc' that consume high CPU and do not respond to kill signals. Inspect dmesg for batman-adv shutdown errors or use-after-free backtraces. Systems with active batman-adv mesh deployments should audit network interface teardown logs and kthread state transitions. Consider enabling kernel address sanitizer (KASAN) in test environments to detect use-after-free memory access attempts. Preventively monitor for unusual interface removal failures or kernel softlockup warnings on batman-adv interfaces.

Why prioritize this

This vulnerability merits immediate patching priority for systems running batman-adv. The combination of local privilege escalation, deterministic exploitability, and denial-of-service impact makes it a critical risk. While batman-adv is not universally deployed, systems that do use it (mesh networks, edge computing, some IoT platforms) face direct compromise risk. The fix is safe and straightforward, making rapid patching feasible without operational risk.

Risk score, explained

The CVSS 3.1 score of 7.8 (High) reflects: (1) Local attack vector (AV:L) requiring user-level access but no special privileges, (2) Low attack complexity (AC:L) due to deterministic counter underflow, (3) Low privilege requirement (PR:L) for triggering network interface operations, (4) No user interaction needed (UI:N), (5) Scope unchanged (S:U), and (6) High impact across confidentiality, integrity, and availability (C:H/I:H/A:H) due to use-after-free enabling privilege escalation and denial of service. The score accurately reflects a high-risk local vulnerability suitable for rapid remediation.

Frequently asked questions