CVE-2026-52916: Linux Kernel batman-adv DoS Vulnerability

CVE-2026-52916 Overview

CVE-2026-52916 is a Linux kernel vulnerability in the batman-adv (B.A.T.M.A.N. Advanced) mesh networking module. The flaw resides in the unicast fragment handling path, where a crafted BATADV_UNICAST_FRAG packet can contain a reassembled payload that is itself another BATADV_UNICAST_FRAG packet. This matryoshka-style nesting causes unbounded recursion through batadv_batman_skb_recv(), exhausting the kernel stack and triggering a denial of service.

Critical Impact
A remote attacker on the mesh network can send nested unicast fragments to recursively invoke the receive path, exhausting the kernel stack and crashing the host.

Affected Products

Linux kernel versions containing the batman-adv module prior to the upstream fix
Stable kernel branches referenced in the kernel.org commit series for this CVE
Distributions shipping vulnerable batman-adv builds

Discovery Timeline

2026-06-24 - CVE-2026-52916 published to NVD
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-52916

Vulnerability Analysis

The batman-adv module implements layer-2 mesh routing and supports unicast packet fragmentation. When a BATADV_UNICAST_FRAG packet arrives, batadv_batman_skb_recv() dispatches it to batadv_frag_skb_buffer(). After all fragments are collected, batadv_recv_frag_packet() calls batadv_batman_skb_recv() again to process the reassembled payload.

The receive path does not validate that the reassembled inner payload is not itself another fragment header. An attacker can encapsulate a BATADV_UNICAST_FRAG packet inside another BATADV_UNICAST_FRAG packet, and repeat the nesting arbitrarily. Each nesting level adds a new stack frame for batadv_batman_skb_recv(), batadv_frag_skb_buffer(), and related callees. With no recursion depth limit, the kernel stack is exhausted and the system panics.

The upstream fix discards any packet that still carries the BATADV_UNICAST_FRAG header after the defragmentation step, since refragmentation and fragments-in-fragments are not legitimate protocol behavior.

Root Cause

The root cause is missing validation of the inner packet type after reassembly. The receive routine recursively re-enters itself on the reassembled buffer without enforcing a bound on protocol-layer nesting, producing unbounded stack growth — a kernel resource exhaustion condition.

Attack Vector

Exploitation requires the ability to inject batman-adv frames into a mesh interface reachable by the target. This typically means an attacker on the same mesh network, an adjacent layer-2 segment, or a compromised mesh peer. No authentication is required at the batman-adv layer. The attacker constructs a single packet whose fragmented payload, once reassembled, contains another fragmented batman-adv header, recursively, until the kernel stack is consumed.

No public proof-of-concept exploit is currently available. See the kernel.org commits for the patch logic: Kernel Git Commit 0c208fa3 and Kernel Git Commit 5418be6c.

Detection Methods for CVE-2026-52916

Indicators of Compromise

Kernel stack overflow panics or oops messages referencing batadv_batman_skb_recv, batadv_frag_skb_buffer, or batadv_recv_frag_packet in the call trace
Repeated soft lockup or hard lockup warnings on hosts that participate in a batman-adv mesh
Unexpected reboots on mesh nodes coinciding with traffic from a specific peer MAC address

Detection Strategies

Monitor kernel logs (dmesg, journalctl -k) for stack traces containing batadv_* symbols
Inspect batman-adv traffic for unicast fragment packets whose reassembled payload begins with another BATADV_UNICAST_FRAG header (packet type 0x04)
Track per-peer fragment reassembly rates and flag peers sending abnormal volumes of fragmented unicast traffic

Monitoring Recommendations

Forward kernel crash dumps and dmesg output to a central log platform for correlation across mesh nodes
Alert on host availability gaps that align with mesh fragment activity from untrusted neighbors
Track installed kernel package versions across the fleet to identify hosts still running pre-patch builds

How to Mitigate CVE-2026-52916

Immediate Actions Required

Update to a Linux kernel build that includes the upstream batman-adv fix discarding nested BATADV_UNICAST_FRAG packets after reassembly
Inventory all hosts running batman-adv, including embedded devices, mesh routers, and IoT gateways, since this module is widely used outside of general-purpose servers
Restrict mesh participation to authenticated and trusted peers using link-layer access controls where supported

Patch Information

The fix is distributed across multiple stable kernel branches. Apply the appropriate backport from the official commits: Kernel Git Commit 5895ad21, Kernel Git Commit 7138c35c, Kernel Git Commit aea54d0b, Kernel Git Commit b54e459c, Kernel Git Commit bc62216d, and Kernel Git Commit bcda4814. After updating, the receive path discards any packet that is still a BATADV_UNICAST_FRAG after defragmentation.

Workarounds

Unload the batman-adv module on hosts that do not require mesh networking: modprobe -r batman_adv and blacklist it to prevent reload
Segment mesh networks from untrusted devices using physical isolation or VLAN boundaries until patched kernels are deployed
Where supported, enable batman-adv distributed ARP table and gateway filtering to reduce exposure to unsolicited fragment traffic from unknown peers

bash

# Configuration example: disable batman-adv on hosts that do not need it
sudo modprobe -r batman_adv
echo "blacklist batman_adv" | sudo tee /etc/modprobe.d/blacklist-batman-adv.conf
sudo update-initramfs -u

# Verify kernel version after patching
uname -r