batman-adv MergedFragment UAF

Vulnerability analysis

During fragment reassembly, batman-adv reuses the socket buffer from the highest-numbered buffered fragment as the merged packet. If the hard interface that originally received that fragment is deleted before the reassembly chain completes, the merged packet retains a stale pointer to the now-freed network device. When the merged packet re-enters the normal receive path, handlers that derive ARP header length from the packet's device pointer dereference the freed structure, causing a use-after-free. The fix refreshes the packet's device metadata from the current receive device before any handler runs, ensuring reinjected merged fragments always reference a valid interface. An attacker on the same mesh network can trigger this by sending fragmented batman-adv packets timed to coincide with interface teardown on the target node; no privileges on the target system are required, but the race window between fragment arrival and interface removal makes reliable exploitation difficult.