CVE-2026-52922: Linux batman-adv NULL Pointer Dereference DoS

Technical summary

CVE-2026-52922 is a NULL pointer dereference in batman-adv's DAT (Distributed ARP Table) module. The batadv_dat_forward_data() function calls pskb_copy_for_clone() to create packet copies for each DHT candidate without validating the return value. Subsequent dereferencing of the potentially NULL skb in batadv_send_skb_prepare_unicast_4addr() leads to a kernel panic. The vulnerability stems from missing error handling for memory allocation failure in a packet forwarding path. The fix involves checking allocation success and skipping the affected DHT candidate if duplication fails, rather than proceeding with a NULL pointer.

Business impact

Systems relying on batman-adv for mesh networking or wireless connectivity face denial-of-service risk. An attacker able to trigger memory pressure or stress the DHT forwarding path could force kernel crashes, disrupting network availability. This is particularly relevant for edge deployments, IoT mesh networks, and community wireless infrastructure that depend on batman-adv. Organizations running affected kernels in memory-constrained environments or under high packet load face elevated risk of unplanned downtime.

Affected systems

The Linux kernel with batman-adv module compiled and enabled is affected. This includes various Linux distributions and embedded systems using batman-adv for mesh networking. The vulnerability impacts kernel versions before the fix was merged; specific patched versions should be verified against your distribution's kernel advisories. Systems not using batman-adv, or those with the module disabled, are not affected.

Exploitability

This is a local denial-of-service vulnerability rather than a remote code execution path. Exploitability requires either triggering genuine memory pressure or crafting a high volume of DHT forwarding requests to stress allocation paths. The attack surface is present on any system with batman-adv enabled and reachable network interfaces. No authentication or user interaction is required; an attacker on the mesh network can trigger the condition. Active exploitation in the wild is not reported (KEV status: not currently in CISA's Known Exploited Vulnerabilities catalog).

Remediation

Apply kernel updates that include the batman-adv DAT allocation error fix. For most distributions, this is available through standard kernel security updates. Verify the patch commit resolves the NULL pointer dereference in batadv_dat_forward_data(). Alternatively, disable batman-adv if not essential to your infrastructure. Test patched kernels in staging environments before production rollout, particularly for memory-constrained systems where allocation failures may be more likely.

Patch guidance

Consult your Linux distribution's security advisories for kernel updates addressing CVE-2026-52922. Patch availability depends on your kernel branch and distribution (e.g., RHEL, Ubuntu, Debian, Alpine). Kernel version numbers differ across distributions, so verify against your vendor's advisory rather than assuming a specific upstream version. Most distributions have released patches through their standard update channels. Reboot is required after kernel updates. For long-term support kernels, patches may be backported separately; check your distribution's release notes.

Detection guidance

Monitor kernel logs (dmesg, syslog) for NULL pointer dereference crashes mentioning batman-adv or batadv_dat functions. Look for kernel panic messages with stack traces referencing batadv_send_skb_prepare_unicast_4addr(). In environments using batman-adv, observe packet loss or sudden mesh network disconnections coinciding with memory pressure events. Use kernel crash dump analysis tools to correlate crashes with allocation failures. Network monitoring tools can detect unusual mesh traffic patterns that might stress the DHT forwarding path, though the vulnerability itself is triggered by allocation pressure rather than specific packet sequences.

Why prioritize this

High CVSS score (7.5) reflects the availability impact, but limited by lack of remote code execution or data breach risk. The vulnerability is straightforward to remediate via kernel update. Prioritize patching for systems where batman-adv is actively used and where network availability is critical. Memory-constrained systems, edge deployments, and high-traffic mesh networks should be prioritized. Systems without batman-adv enabled can defer patching to routine maintenance windows.

Risk score, explained

CVSS 3.1 score of 7.5 (HIGH) reflects a network-accessible denial-of-service vulnerability with no authentication barrier and high impact to availability. The score does not account for confidentiality or integrity (both unaffected), and assumes local network reach to the mesh (AV:N reflects network-adjacent attack surface on mesh topologies). The lack of widespread active exploitation and the simplicity of the fix prevent a CRITICAL rating, but the high availability impact and ease of triggering under memory pressure justify HIGH severity.

Frequently asked questions