CVE-2026-52919: Linux Kernel Use-After-Free Vulnerability

CVE-2026-52919 Overview

CVE-2026-52919 is a use-after-free vulnerability in the Linux kernel's batman-adv (B.A.T.M.A.N. Advanced) mesh networking module. The flaw resides in the throughput meter (tp_meter) subsystem, where batadv_tp_sender_shutdown() unconditionally decrements the sending atomic counter. When multiple shutdown paths execute concurrently, such as a timeout, a user-initiated cancel, and a normal session completion, the counter underflows below zero. The sender logic treats any non-zero value as an active session, so a negative counter forces the sender kthread into an infinite loop. Removing the interface while this zombie thread remains active triggers a use-after-free condition in kernel memory.

Critical Impact
A counter underflow in the batman-adv throughput meter creates a zombie kernel thread that accesses freed memory after interface removal, leading to kernel-level use-after-free.

Affected Products

Linux kernel with batman-adv module enabled (multiple stable branches)
Systems using B.A.T.M.A.N. Advanced mesh networking
Distributions shipping affected stable kernel versions prior to the fix commits

Discovery Timeline

2026-06-24 - CVE-2026-52919 published to NVD
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-52919

Vulnerability Analysis

The defect lies in the lifecycle management of the tp_meter sender state. The batadv_tp_sender_shutdown() function decrements the sending atomic counter without checking whether the transition is valid. Three distinct execution paths can invoke this shutdown routine: the session timeout handler, a user-initiated cancellation through the generic netlink interface, and the normal completion path when measurement finishes. Each path independently calls the shutdown function, decrementing the counter beyond zero.

Once the counter reaches -1, the sender kthread loop condition, which checks for any non-zero value, evaluates as true indefinitely. The kthread never exits. When an administrator removes the underlying batman-adv interface, the associated memory structures are released while the looping kthread still references them, producing a use-after-free [CWE-416].

Root Cause

The root cause is an atomicity violation in counter state transitions. The original code performs an unconditional atomic_dec() rather than a guarded compare-and-swap. The fix replaces the decrement with atomic_xchg(), ensuring the counter transitions from 1 to 0 exactly once regardless of how many shutdown paths execute. The companion change to batadv_tp_send enforces the same invariant on the sending side.

Attack Vector

Exploitation requires local capability to manipulate batman-adv interfaces and trigger concurrent tp_meter operations. An attacker with permission to initiate throughput measurements and remove network interfaces can race the shutdown paths to underflow the counter. The resulting use-after-free can lead to kernel memory corruption, denial of service through kernel panic, or potential privilege escalation depending on the freed object's reuse pattern. The vulnerability is not remotely exploitable without prior local access.

The vulnerability manifests in the shutdown synchronization logic. See the Linux Kernel Commit for the patch implementation.

Detection Methods for CVE-2026-52919

Indicators of Compromise

Kernel log entries referencing batman-adv and tp_meter near interface teardown events
Persistent kernel threads associated with batman-adv that fail to exit after interface removal
Kernel oops or panic messages citing use-after-free in batadv_tp_send or related symbols
Unexpected CPU consumption by a batadv kthread after a tp_meter session completes

Detection Strategies

Audit the running kernel version against the fixed stable releases referenced in the upstream commits
Inspect /proc/<pid>/stack for batman-adv kthreads that remain active after their session ended
Monitor dmesg for KASAN reports flagging use-after-free in the batman-adv module
Correlate batman-adv interface removal events with subsequent kernel instability

Monitoring Recommendations

Enable KASAN (CONFIG_KASAN) on test systems running batman-adv to surface latent corruption
Forward kernel logs to a centralized log platform for retroactive analysis of kthread anomalies
Track package inventory of kernel versions across mesh-networking deployments to identify unpatched hosts

How to Mitigate CVE-2026-52919

Immediate Actions Required

Update affected Linux kernels to versions containing the upstream fix commits
For systems that cannot patch immediately, unload the batman-adv module if mesh networking is not required (modprobe -r batman_adv)
Restrict local access to users who can invoke batctl tp measurements and manage batman-adv interfaces

Patch Information

The fix replaces the unconditional counter decrement with atomic_xchg() in batadv_tp_sender_shutdown(), with a companion correction in batadv_tp_send. Stable kernel commits include 01cefc59, 90ae3eae, 94f3b133, abae88fa, aeae11c5, c1bac194, c66d20a3, and e75e2ab4. Apply the kernel update appropriate for your distribution's stable branch.

Workarounds

Blacklist the batman_adv kernel module on hosts that do not require mesh networking by adding blacklist batman_adv to /etc/modprobe.d/
Avoid running concurrent tp_meter sessions and interface teardown operations on unpatched hosts
Limit CAP_NET_ADMIN to trusted administrative accounts to reduce the local attack surface

bash

# Configuration example: disable the batman-adv module until patched
echo 'blacklist batman_adv' | sudo tee /etc/modprobe.d/disable-batman-adv.conf
sudo modprobe -r batman_adv
uname -r  # verify running kernel matches a patched stable release