CVE-2026-52926: Linux Batman-adv Mesh Teardown Gateway State Bug

Technical summary

batadv_gw_node_free() performs gateway node cleanup during mesh teardown but does not null out bat_priv->gw.curr_gw. This allows the kernel to retain a reference to a gateway object that has been freed or is no longer valid. The vulnerability occurs because the function walks the gateway list and frees entries without first releasing the current gateway selection. On subsequent mesh recreation, the stale curr_gw pointer can reference invalid memory or cause improper state initialization. The remediation requires clearing the current gateway reference (bat_priv->gw.curr_gw = NULL) prior to the list walk to ensure proper cleanup semantics.

Business impact

This bug affects systems that create and destroy batman-adv mesh networks repeatedly—common in dynamic wireless networks, IoT mesh deployments, and edge computing environments. When a mesh is torn down and recreated, the stale gateway state prevents proper mesh reinitialization, leading to mesh connectivity failures, routing errors, or potential denial-of-service conditions. Organizations relying on batman-adv for critical mesh infrastructure must patch to avoid service interruptions. The impact is localized to the affected host and does not propagate to network neighbors, but repeated teardown/recreation cycles will trigger the failure consistently.

Affected systems

The Linux kernel is affected across all versions that include the batman-adv module with this code path. Batman-adv is used in embedded Linux systems, IoT devices, mesh routers, and specialized networking appliances. The vulnerability applies to systems that dynamically manage mesh interfaces—bringing them up and down or reconfiguring mesh topology. Desktop and server deployments using static mesh configurations may be less affected unless they perform mesh teardown as part of their normal operational cycle.

Exploitability

Exploitation requires local access to the affected system with sufficient privilege to interact with mesh network interfaces. This is not a remote code execution vector. An attacker cannot remotely trigger the vulnerability without first gaining local network access and the ability to manipulate network interfaces. The CVSS score of 5.5 (MEDIUM) reflects local access, low privilege requirements, and high availability impact with no confidentiality or integrity compromise. The vulnerability is deterministic—mesh recreation will reliably trigger the stale state condition—but does not enable privilege escalation or code execution.

Remediation

Apply a Linux kernel patch that clears bat_priv->gw.curr_gw before the gateway list walk in batadv_gw_node_free(). This one-line fix ensures the current gateway reference is released as part of normal teardown. Organizations should verify patch availability from their Linux distribution or the upstream kernel maintainers and test in staging environments that exercise mesh recreation scenarios before production deployment.

Patch guidance

Patch status and version numbers should be verified against your Linux distribution's security advisories and the upstream kernel repository. Monitor your vendor's kernel release notes for batches that address batman-adv teardown handling. Test patches in a staging environment that recreates mesh networks to confirm the fix resolves stale state issues. Prioritize patching for systems that dynamically manage mesh interfaces in production.

Detection guidance

Detect this vulnerability by checking kernel logs for repeated mesh initialization failures, particularly when mesh interfaces are brought down and then back up. Look for batman-adv related warnings or crashes in dmesg during mesh teardown/recreation cycles. On vulnerable systems, tools like batctl can report inconsistent gateway state or selection errors after mesh restart. Implement monitoring for mesh interface state transitions and alert on repeated teardown/recreation patterns that may trigger the bug in production.

Why prioritize this

This issue should be prioritized for systems that rely on dynamic batman-adv mesh deployments. While the CVSS score is MEDIUM, the practical impact is high for affected workloads because mesh recreation is often part of normal operations in mobile, edge, and IoT environments. The fix is minimal and low-risk, making it a straightforward patch decision. Organizations not using batman-adv mesh networking can defer this with lower risk.

Risk score, explained

The CVSS 3.1 score of 5.5 reflects a local attack vector with low privilege requirements and no special interaction. The high availability impact acknowledges that mesh teardown/recreation failures will cause service disruption on affected systems. The lack of confidentiality and integrity impact limits the score, since the vulnerability does not leak data or corrupt it—only causes denial of service through state inconsistency. For batman-adv deployments, the practical risk is higher than the numerical score suggests because mesh availability is mission-critical.

Frequently asked questions