CVE-2026-52926: Linux Kernel Privilege Escalation Flaw

CVE-2026-52926 Overview

CVE-2026-52926 is a Linux kernel vulnerability in the batman-adv (B.A.T.M.A.N. Advanced) mesh networking module. The function batadv_gw_node_free() removes gateway list entries during mesh teardown but fails to clear the currently selected gateway stored in bat_priv->gw.curr_gw. This leaves a stale gateway reference behind across cleanup operations. The residual state can disrupt a later mesh recreation on the same interface. Upstream maintainers resolved the issue by clearing bat_priv->gw.curr_gw before walking the gateway list, ensuring the selected gateway reference is dropped as part of teardown.

Critical Impact
A stale gateway reference persists after mesh teardown in the batman-adv subsystem, which can break subsequent mesh recreation and leave dangling kernel state.

Affected Products

Linux kernel batman-adv mesh networking module
Multiple stable kernel branches fixed via commits 17e3a441, 30bda3ef, 6de089b5, 9a1a8ed4, a340a51e, a3f3f1ec, ae7aeb0c, and e2ec4c71
Distributions shipping unpatched Linux kernels with CONFIG_BATMAN_ADV enabled

Discovery Timeline

2026-06-24 - CVE-2026-52926 published to NVD
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-52926

Vulnerability Analysis

The batman-adv module implements layer-2 mesh routing in the Linux kernel. Each mesh interface tracks a list of available gateways and a pointer to the currently selected gateway through bat_priv->gw.curr_gw. During teardown, batadv_gw_node_free() iterates the gateway list and frees the entries it owns. The original implementation did not drop the reference held by curr_gw before iterating. As a result, the selected gateway pointer remained populated after teardown completed. When the mesh was recreated on the same interface, the stale pointer interfered with proper gateway selection and reference accounting. The fix clears bat_priv->gw.curr_gw before the list walk so the reference is released as part of the normal teardown path.

Root Cause

The root cause is incomplete cleanup logic in batadv_gw_node_free(). The teardown routine released list entries without resetting the cached selected-gateway pointer, producing a reference and state-tracking inconsistency between the gateway list and curr_gw.

Attack Vector

This issue is reachable only through local kernel operations that bring batman-adv mesh interfaces up and down. It is not a remote network attack. The practical effect is operational: mesh recreation can fail or behave incorrectly after a teardown cycle. Exploitability for privilege escalation has not been established, and no public proof of concept is referenced in the advisory.

No verified exploit code is available. See the kernel fix commit 17e3a441 for the patch context.

Detection Methods for CVE-2026-52926

Indicators of Compromise

No malware or network IOCs apply; the issue is a kernel state bug rather than an exploited vulnerability.
Failed or inconsistent mesh recreation events on hosts using batman-adv after interface teardown.
Kernel log anomalies referencing batman-adv gateway selection following module reload or interface cycling.

Detection Strategies

Inventory Linux hosts where CONFIG_BATMAN_ADV is built or loaded as a module via lsmod | grep batman_adv.
Compare installed kernel versions against the patched commits listed in the advisory references.
Track repeated batman-adv interface teardown and recreation cycles in system logs to identify hosts most exposed to the defect.

Monitoring Recommendations

Forward dmesg and journald kernel facility events to a central log platform and alert on batman_adv errors.
Monitor configuration management state for kernel package versions to confirm patch deployment across fleets.
Include mesh networking nodes in routine kernel patch compliance reviews.

How to Mitigate CVE-2026-52926

Immediate Actions Required

Update affected Linux kernels to a stable release that includes the upstream fix commits referenced in the advisory.
If patching is not immediately possible, avoid repeatedly tearing down and recreating batman-adv mesh interfaces on the same host.
Unload the batman_adv module on systems that do not require mesh networking using modprobe -r batman_adv.

Patch Information

The fix has been merged into multiple stable kernel branches. Apply the kernel update from your distribution that incorporates one of the following commits: 17e3a441, 30bda3ef, 6de089b5, 9a1a8ed4, a340a51e, a3f3f1ec, ae7aeb0c, or e2ec4c71. The fix clears bat_priv->gw.curr_gw before iterating the gateway list during teardown.

Workarounds

Blacklist the batman_adv module on hosts that do not use mesh routing by adding blacklist batman_adv to /etc/modprobe.d/.
Restrict permissions to administer mesh interfaces to limit exposure to the teardown path.
Reboot affected systems after kernel updates to ensure the patched module is loaded.

bash

# Verify batman-adv module status and kernel version
uname -r
lsmod | grep batman_adv
# Prevent loading where not required
echo 'blacklist batman_adv' | sudo tee /etc/modprobe.d/disable-batman-adv.conf
sudo modprobe -r batman_adv