CVE-2026-43382 Overview
CVE-2026-43382 is a Linux kernel vulnerability in the batman-adv mesh networking module. The flaw resides in the Echo Location Protocol (ELP) metric worker function batadv_v_elp_get_throughput(). The function can be invoked while the Routing Netlink (RTNL) lock is already held, leading to a potential deadlock condition.
While the function previously used rtnl_trylock() to avoid this issue, the code path for cfg80211 wireless interfaces called batadv_get_real_netdev(), which itself acquires rtnl_lock() unconditionally. This nested locking attempt creates a double-lock scenario when work queue items are cancelled via cancel_delayed_work_sync() in batadv_v_elp_iface_disable().
Critical Impact
A deadlock in the batman-adv ELP worker can stall kernel network operations and trigger a denial of service on systems using batman-adv mesh networking over cfg80211 wireless interfaces.
Affected Products
- Linux kernel versions containing the batman-adv module with cfg80211 support
- Mesh networking deployments using batman-adv over wireless interfaces
- Embedded and IoT devices relying on batman-adv routing
Discovery Timeline
- 2026-05-08 - CVE-2026-43382 published to NVD
- 2026-05-12 - Last updated in NVD database
Technical Details for CVE-2026-43382
Vulnerability Analysis
The vulnerability is a deadlock condition [CWE-833] in the batman-adv mesh routing protocol implementation. The batadv_v_elp_get_throughput() function retrieves throughput metrics for ELP packets used in mesh path selection. The function can execute in contexts where the RTNL lock is already held by the caller.
The original mitigation used rtnl_trylock() to bail out of ethtool information retrieval when the lock was contended. However, the cfg80211 wireless interface code path calls batadv_get_real_netdev() to resolve the underlying network device. This helper acquires rtnl_lock() unconditionally, defeating the trylock protection.
When batadv_v_elp_iface_disable() invokes cancel_delayed_work_sync() on the ELP worker while holding RTNL, and the worker simultaneously attempts to acquire RTNL through the cfg80211 path, the kernel hits a deadlock.
Root Cause
The root cause is inconsistent lock handling across two code paths. The ethtool path correctly used __ethtool_get_link_ksettings() to operate without re-acquiring RTNL. The cfg80211 path failed to use an equivalent lockless variant, instead calling the locking version batadv_get_real_netdev() which blocks waiting for a lock the current thread already holds.
Attack Vector
This vulnerability is a local denial of service condition triggered by specific interface lifecycle events on batman-adv mesh nodes using wireless interfaces. Triggering the deadlock requires the ability to enable or disable batman-adv interfaces or stress the work queue cancellation path. The fix replaces the locking call with the lockless __batadv_get_real_netdev() helper, mirroring the ethtool approach. See the kernel commit fa7b4ed for the upstream resolution.
Detection Methods for CVE-2026-43382
Indicators of Compromise
- Kernel hung task warnings referencing batadv_v_elp_get_throughput or batadv_v_elp_iface_disable in dmesg and journalctl -k output
- Soft lockup or RCU stall messages naming the batman-adv work queue
- Unresponsive network interfaces tied to a batman-adv mesh after enabling or disabling a member interface
Detection Strategies
- Inventory Linux hosts that load the batman_adv kernel module using lsmod and confirm whether cfg80211 wireless interfaces participate in the mesh
- Compare running kernel versions against the patched commits listed in the kernel.org references to identify unpatched systems
- Monitor for repeated work queue cancellation events on batman-adv interfaces that correlate with interface flaps
Monitoring Recommendations
- Forward kernel logs to a centralized logging system and alert on hung_task_timeout_secs warnings involving batman-adv symbols
- Track interface state changes on mesh nodes to identify abnormal disable cycles
- Establish baseline kernel versions across mesh deployments and alert when nodes diverge from the patched baseline
How to Mitigate CVE-2026-43382
Immediate Actions Required
- Identify all Linux systems running batman-adv with cfg80211 wireless interfaces and prioritize them for kernel updates
- Apply the upstream kernel patches referenced on kernel.org to stable branches in use
- Restart affected systems after patching to ensure the corrected batman-adv module is loaded
Patch Information
The upstream fix replaces the locking batadv_get_real_netdev() call with the lockless __batadv_get_real_netdev() variant in the ELP throughput retrieval path. Patched commits are available across multiple stable branches, including 192f40a, 2ab9f25, 4c3ae24, 77808fe, b7e5d8d, cfc83a3, f3ca456, and fa7b4ed.
Workarounds
- Unload the batman_adv module on systems that do not require mesh networking until a patched kernel is deployed
- Avoid repeated enable/disable cycles on batman-adv wireless interfaces on unpatched kernels to reduce the probability of triggering the deadlock
- Where mesh functionality is required, restrict batman-adv to non-cfg80211 interfaces until patching is complete
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
