CVE-2026-52913: Linux Kernel Use-After-Free Vulnerability

CVE-2026-52913 Overview

CVE-2026-52913 is a NULL pointer dereference vulnerability in the Linux kernel's batman-adv (B.A.T.M.A.N. Advanced) mesh networking module. The flaw resides in the OGMv2 (Originator Message version 2) transmission path. When a batadv_hard_iface is disabled, its mesh_iface pointer is set to NULL, but batadv_v_ogm_send_meshif() may still dispatch OGMs through batadv_v_ogm_queue_on_if() for interfaces that have lost their mesh association. The function unconditionally calls netdev_priv() on the now-NULL hard_iface->mesh_iface to retrieve batadv_priv, triggering a kernel NULL pointer dereference.

Critical Impact
A race between interface disable and OGMv2 dispatch can crash the kernel on systems running batman-adv mesh networking.

Affected Products

Linux kernel versions containing the batman-adv OGMv2 implementation prior to the referenced stable commits
Distributions and devices using batman-adv for mesh routing (commonly OpenWrt, community mesh networks, embedded routers)
Linux stable trees patched via commits 040fe8e, 1be1e99, 31dcb97, 4ff461a, 70c9f6a, aad70db, d7391a2, and f8ce8b83

Discovery Timeline

2026-06-24 - CVE-2026-52913 published to NVD
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-52913

Vulnerability Analysis

The batman-adv module implements a Layer 2 mesh routing protocol in the Linux kernel. OGMv2 messages are periodically transmitted to advertise originator presence and link metrics. The transmission path batadv_v_ogm_send_meshif() enqueues outgoing OGMs onto each member hard interface using batadv_v_ogm_queue_on_if(). That helper retrieves the per-interface batman state by calling netdev_priv(hard_iface->mesh_iface).

When an administrator disables a hard interface, the cleanup path sets hard_iface->mesh_iface = NULL. Because OGM dispatch is not synchronized with the disable transition, an in-flight send can reach batadv_v_ogm_queue_on_if() after the pointer has been cleared. Dereferencing the NULL mesh_iface produces a kernel oops, leading to denial of service. This is classified as a NULL Pointer Dereference [CWE-476].

Root Cause

The root cause is missing validation in batadv_v_ogm_queue_on_if(). The function assumed hard_iface->mesh_iface remained valid for the lifetime of the send operation. There was no check that the interface still belonged to the same mesh for which batadv_v_ogm_send_meshif() was originally invoked. The fix ensures the queue function verifies it operates on the same mesh_iface that initiated the send.

Attack Vector

Triggering the condition requires local administrative actions that toggle batman-adv hard interfaces while OGMv2 traffic is active. An attacker with privileges to enable and disable mesh interfaces, or an automated mesh management agent reacting to link state changes, can race the OGM dispatcher and crash the kernel. The vulnerability does not provide code execution; impact is limited to availability of the affected host.

No public proof-of-concept exploit is referenced in the advisory. The fix is described in the upstream kernel commits referenced below.

Detection Methods for CVE-2026-52913

Indicators of Compromise

Kernel oops or panic messages referencing batadv_v_ogm_queue_on_if or batadv_v_ogm_send_meshif in dmesg or /var/log/kern.log
Unexpected reboots on hosts running batman-adv when mesh interfaces are toggled
Stack traces showing NULL pointer dereference within the batman_adv module

Detection Strategies

Audit running kernel versions against the patched stable releases referenced in the kernel.org commits
Monitor lsmod output for the batman_adv module on production systems to identify exposed hosts
Parse kernel ring buffer logs for BUG: kernel NULL pointer dereference entries correlated with batman-adv symbols

Monitoring Recommendations

Forward kernel logs to a centralized logging or SIEM platform and alert on batman_adv oops signatures
Track interface state changes on mesh nodes and correlate with kernel crash events
Inventory embedded devices and OpenWrt-derived systems for batman-adv usage and patch status

How to Mitigate CVE-2026-52913

Immediate Actions Required

Update the Linux kernel to a stable release containing one of the fix commits: 040fe8e, 1be1e99, 31dcb97, 4ff461a, 70c9f6a, aad70db, d7391a2, or f8ce8b83
Identify hosts running the batman_adv kernel module and prioritize them for patching
Restrict administrative access to mesh interface configuration on production systems

Patch Information

The upstream fix adds a check in batadv_v_ogm_queue_on_if() to verify it is operating on the same mesh_iface for which batadv_v_ogm_send_meshif() was called. This prevents dispatch onto interfaces whose mesh_iface pointer has been cleared during disable. Apply the corresponding stable kernel update for your distribution.

Workarounds

Unload the batman_adv kernel module on systems that do not require mesh networking using modprobe -r batman_adv
Avoid runtime enable and disable cycles of batman-adv hard interfaces until patches are applied
Restrict capabilities such as CAP_NET_ADMIN to trusted accounts to limit who can toggle mesh interfaces

bash

# Verify kernel version and check whether batman_adv is loaded
uname -r
lsmod | grep batman_adv

# If batman-adv is not required, remove the module and blacklist it
sudo modprobe -r batman_adv
echo 'blacklist batman_adv' | sudo tee /etc/modprobe.d/blacklist-batman-adv.conf