CVE-2026-46212: Linux Kernel Use-After-Free Vulnerability

CVE-2026-46212 Overview

CVE-2026-46212 is a use-after-free vulnerability in the Linux kernel's batman-adv (Better Approach To Mobile Ad-hoc Networking) module. The flaw resides in the Bridge Loop Avoidance (BLA) subsystem, specifically inside the batadv_bla_del_backbone_claims() function. When the function removes all claims associated with a backbone, it drops the hash list entry that itself holds one of the references protecting the claim object. If batadv_claim_put() runs before the final access to the claim, batadv_claim_release() can free the object while it is still being used.

Critical Impact
A use-after-free in kernel networking code can lead to memory corruption, kernel crashes, and potential local privilege escalation on systems running the batman-adv mesh networking module.

Affected Products

Linux kernel versions containing the vulnerable batadv_bla_del_backbone_claims() implementation
Distributions and devices using the batman-adv mesh networking module
Embedded systems and routers relying on B.A.T.M.A.N. Advanced for layer-2 mesh routing

Discovery Timeline

2026-05-28 - CVE-2026-46212 published to NVD
2026-05-28 - Last updated in NVD database

Technical Details for CVE-2026-46212

Vulnerability Analysis

The batman-adv module implements a Bridge Loop Avoidance mechanism that tracks MAC address claims per backbone gateway. Each claim is stored in a hash table and is reference-counted to coordinate concurrent access between worker threads, network receive paths, and cleanup routines. The function batadv_bla_del_backbone_claims() is responsible for tearing down all claims tied to a backbone when the backbone is removed.

During teardown, the function walks the claim hash and removes each entry from the list. The hash list link itself represents a reference on the claim object. Releasing that reference through batadv_claim_put() decrements the refcount, and when it reaches zero the kernel schedules batadv_claim_release(), which frees the underlying memory. If the cleanup logic invokes batadv_claim_put() before completing all reads against the claim, subsequent dereferences operate on freed memory.

Root Cause

The root cause is incorrect ordering between the reference release and the last field access on the claim object inside batadv_bla_del_backbone_claims(). The function dropped the list-entry reference too early, allowing the release callback to free the object while the iteration code still required pointers within it. This is a classic Use-After-Free (UAF) pattern in reference-counted kernel data structures.

Attack Vector

Exploitation requires conditions where the BLA subsystem performs backbone claim deletion under concurrent activity. An attacker on the mesh network or a local actor capable of triggering backbone churn could race the deletion path against other claim accesses. Successful exploitation can corrupt kernel memory, crash the host with a denial of service, or, with additional primitives, escalate privileges. The vulnerability is described in the upstream batman-adv kernel patch series and accompanying stable kernel fixes.

Detection Methods for CVE-2026-46212

Indicators of Compromise

Kernel oops or panic messages referencing batadv_claim_release, batadv_bla_del_backbone_claims, or batman_adv in dmesg or /var/log/kern.log
KASAN reports flagging use-after-free reads or writes within the batman-adv module
Unexpected restarts on mesh gateways or nodes participating in BLA-enabled bridges

Detection Strategies

Enable KASAN on test systems running batman-adv to surface UAF conditions during fuzzing or stress testing
Monitor kernel ring buffers on production mesh nodes for warnings and stack traces involving batadv_bla_* symbols
Inventory hosts loading the batman_adv kernel module using lsmod and correlate against patch status

Monitoring Recommendations

Forward kernel logs from mesh routers and Linux endpoints to a centralized logging system for anomaly review
Alert on repeated module-specific stack traces or sudden reboots of devices running mesh networking
Track kernel package versions across the fleet and flag systems still running pre-patch builds

How to Mitigate CVE-2026-46212

Immediate Actions Required

Apply the upstream batman-adv fix by updating to a Linux kernel build that includes the corrected ordering in batadv_bla_del_backbone_claims()
Identify systems loading batman_adv and prioritize patching for mesh gateways, IoT devices, and community network nodes
Rebuild and redeploy custom kernels and out-of-tree batman-adv builds against the patched source

Patch Information

The issue is resolved through a series of stable-tree commits that reorder the reference drop relative to the last access on the claim object. Refer to the primary kernel commit, the backported stable fix, and the additional stable update for the full change set.

Workarounds

Unload the batman_adv module on systems that do not require mesh networking using modprobe -r batman_adv
Blacklist the module in /etc/modprobe.d/ on hosts where mesh functionality is not needed
Restrict physical and layer-2 access to mesh interfaces to limit who can trigger backbone churn

bash

# Configuration example
# Verify whether batman-adv is loaded
lsmod | grep batman_adv

# Temporarily unload the module if mesh networking is not required
sudo modprobe -r batman_adv

# Permanently disable the module until patched kernels are deployed
echo "blacklist batman_adv" | sudo tee /etc/modprobe.d/disable-batman-adv.conf
sudo update-initramfs -u