KernelScan.io

HIGH

batman-adv Claim UAF

CVE-2026-46212

CVSS 8.8 / 10.0 NVD

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

KernelScan AI8.3HIGH

01

In the Linux kernel, the following vulnerability has been resolved: batman-adv: bla: prevent use-after-free when deleting claims When batadv_bla_del_backbone_claims() removes all claims for a backbone, it does this by dropping the link entry in the hash list. This list entry itself was one of the references which need to be dropped at the same time via batadv_claim_put(). But the batadv_claim_put() must not be done before the last access to the claim object in this function. Otherwise the claim might be freed already by the batadv_claim_release() function before the list entry was dropped.

02

Engine v0.2.0

Risk summary

A use-after-free vulnerability in batman-adv's bridge loop avoidance code allows adjacent network attackers to corrupt kernel memory or cause a denial of service. The flaw occurs when deleting backbone claims, where a claim object may be freed before its hash list entry is removed, leading to deterministic heap memory corruption and potential kernel crashes.

Affectednet/batman-adv/bridge_loop_avoidance.c (batman-adv)

Vulnerability analysis

The vulnerability stems from incorrect ordering of operations in batadv_bla_del_backbone_claims(). The function calls batadv_claim_put() before hlist_del_rcu(), which can cause the claim object to be freed while the list deletion code still writes to it. Because hlist_del_rcu dereferences the claim to update hash list pointers, dropping the reference first results in a deterministic use-after-free write to heap memory. The fix reorders these operations to drop the reference only after the hash list entry is removed. This affects batman-adv mesh nodes with bridge loop avoidance enabled and requires adjacent network access to trigger.

03

BranchFixed inPatch commit
5.105.10.2581d4b241482d9
5.155.15.209a1a99837bb61
6.16.1.175b88c865dcf6e
6.126.12.906c5dc6d68e6b
6.186.18.3200155f336a5e
6.66.6.140368449e467d5
7.07.0.90cc9847c64cb
mainline7.1-rc44ae1709a3140