CVE-2026-52922: Linux Kernel batman-adv DoS Vulnerability

CVE-2026-52922 Overview

CVE-2026-52922 is a NULL pointer dereference vulnerability in the Linux kernel's batman-adv (B.A.T.M.A.N. Advanced) mesh networking module. The flaw resides in the Distributed ARP Table (DAT) forwarding logic. Specifically, batadv_dat_forward_data() calls pskb_copy_for_clone() to duplicate a socket buffer (skb) for each DHT candidate but fails to validate the return value before passing the result to batadv_send_skb_prepare_unicast_4addr(). When the cloning allocation fails, the downstream function dereferences a NULL pointer, triggering a kernel crash.

Critical Impact
A failed skb allocation during DAT forwarding causes a NULL pointer dereference in kernel space, resulting in a kernel oops and potential denial of service on systems using batman-adv mesh networking.

Affected Products

Linux kernel versions containing the batman-adv module prior to the fixes referenced in the upstream stable commits
Linux distributions shipping batman-adv mesh networking support
Embedded and mesh networking deployments using B.A.T.M.A.N. Advanced routing

Discovery Timeline

2026-06-24 - CVE-2026-52922 published to NVD
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-52922

Vulnerability Analysis

The batman-adv module implements a Distributed ARP Table that caches IP-to-MAC mappings across mesh nodes. When forwarding DAT messages, batadv_dat_forward_data() iterates over Distributed Hash Table (DHT) candidates and clones the original skb for each recipient using pskb_copy_for_clone(). The kernel returns NULL from this helper when memory allocation fails under pressure.

The vulnerable code passes the unchecked pointer directly into batadv_send_skb_prepare_unicast_4addr(). That helper dereferences the skb without a NULL guard, producing a NULL pointer dereference in kernel context. The fix skips forwarding to the current DHT candidate when allocation fails, allowing iteration to continue safely.

Root Cause

The root cause is missing return-value validation after an allocation call inside a loop. pskb_copy_for_clone() can legitimately return NULL under memory pressure, but the caller treats the result as always valid. This is a classic [CWE-476] NULL pointer dereference pattern in error-handling paths.

Attack Vector

Triggering the condition requires the kernel to fail an skb clone during DAT forwarding. This typically occurs under memory exhaustion. An adversary on the same mesh segment who can induce DAT traffic, combined with memory pressure on the forwarding node, may provoke the crash. Exploitation is limited to denial of service; no code execution primitive is documented.

The vulnerability mechanism is described in the upstream commits referenced in this advisory. See the Linux Kernel Commit 2d8826a and related stable backports for the technical fix.

Detection Methods for CVE-2026-52922

Indicators of Compromise

Kernel oops or panic messages referencing batadv_dat_forward_data or batadv_send_skb_prepare_unicast_4addr in dmesg or /var/log/kern.log
Unexpected reboots or hangs on mesh nodes running batman-adv under memory pressure
NULL pointer dereference stack traces involving the batman-adv kernel module

Detection Strategies

Monitor kernel logs for crash signatures within the batman-adv call stack using centralized log collection
Inventory hosts loading the batman_adv kernel module via lsmod to identify exposure
Track kernel package versions against the fixed stable releases referenced in the upstream commits

Monitoring Recommendations

Forward kern.log and dmesg output to a centralized SIEM for kernel oops correlation
Alert on repeated kernel module failures or unscheduled reboots on mesh routers and embedded devices
Track memory pressure metrics on mesh-enabled hosts to correlate allocation failures with crashes

How to Mitigate CVE-2026-52922

Immediate Actions Required

Identify all systems with the batman_adv kernel module loaded and prioritize them for patching
Apply the latest stable Linux kernel update from your distribution vendor that includes the upstream fix
If patching is not immediately feasible, unload the module on hosts that do not require mesh networking

Patch Information

The upstream fix adds a NULL check after pskb_copy_for_clone() and skips forwarding to the current DHT candidate when allocation fails. The fix is available across multiple stable branches via the following commits: Linux Kernel Commit 2d8826a, Linux Kernel Commit 2edb8ae, Linux Kernel Commit 4d420d9, Linux Kernel Commit 866ac1d, Linux Kernel Commit 9bcebaed, Linux Kernel Commit 9cceea8, Linux Kernel Commit ce0c381, and Linux Kernel Commit cf48e75.

Workarounds

Blacklist the batman_adv module on systems that do not require mesh routing functionality
Restrict mesh network membership and segment untrusted nodes to limit DAT traffic exposure
Maintain adequate free memory and tune vm.min_free_kbytes to reduce the likelihood of allocation failure on mesh forwarders

bash

# Verify whether batman-adv is loaded and blacklist it if unused
lsmod | grep batman_adv

# Blacklist the module to prevent automatic loading
echo "blacklist batman_adv" | sudo tee /etc/modprobe.d/blacklist-batman-adv.conf

# Unload the running module (ensure no active mesh dependencies)
sudo modprobe -r batman_adv

# Confirm kernel version after applying distribution patches
uname -r