CVE-2026-52931: Linux Kernel Use-After-Free Vulnerability

CVE-2026-52931 Overview

CVE-2026-52931 is a Linux kernel vulnerability in the batman-adv (Better Approach To Mobile Ad-hoc Networking, advanced) mesh networking module. The flaw resides in the throughput meter (tp_meter) subsystem, where the functions batadv_tp_recv_ack() and batadv_tp_stop() access sender-only members of tp_vars without first validating the role. When a node currently acting as a receiver in an ongoing tp_meter session receives a crafted ACK packet, the kernel reads uninitialized memory, producing undefined behavior. This is classified as an Uninitialized Memory Use issue and was resolved upstream by checking tp_vars->role immediately after the lookup and bailing out if it is not BATADV_TP_SENDER.

Critical Impact
A remote attacker on the same mesh network can trigger undefined kernel behavior by sending a malicious ACK packet to a node participating as a receiver in a tp_meter session.

Affected Products

Linux kernel versions containing the batman-advtp_meter implementation prior to the fix
Distributions shipping vulnerable mainline and stable Linux kernel branches
Mesh networking deployments using batman-adv for layer 2 routing

Discovery Timeline

2026-06-24 - CVE-2026-52931 published to NVD
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-52931

Vulnerability Analysis

The batman-adv kernel module implements a throughput meter (tp_meter) that maintains per-session state in a tp_vars structure. Each session has a role: BATADV_TP_SENDER or BATADV_TP_RECEIVER. The sender role initializes additional fields used for congestion control, RTT measurement, and acknowledgement tracking. The receiver role leaves these fields uninitialized because it does not need them.

The functions batadv_tp_recv_ack() and batadv_tp_stop() assume they are operating on sender-side state. However, the lookup that selects the matching tp_vars does not enforce a role check before these functions access sender-only members. An attacker who sends an ACK packet that resolves to a receiver-role session causes the kernel to read fields that were never written.

Root Cause

The root cause is missing role validation after a session lookup. The code path proceeds directly to dereferencing sender-only members of tp_vars without verifying that tp_vars->role == BATADV_TP_SENDER. This produces an Uninitialized Memory Use condition in kernel context.

Attack Vector

Exploitation requires the target node to be an active receiver in a tp_meter session on a batman-adv mesh. An adjacent attacker on the same mesh crafts an ACK packet that the node correlates to the receiver-role session. The kernel then executes batadv_tp_recv_ack() against uninitialized sender state, producing undefined behavior that ranges from incorrect protocol decisions to potential memory disclosure or crashes depending on stack contents. No verified public proof-of-concept is currently available. See the upstream kernel commit for the corrective patch.

Detection Methods for CVE-2026-52931

Indicators of Compromise

Unexpected kernel warnings, KASAN reports, or oops messages referencing batadv_tp_recv_ack or batadv_tp_stop in dmesg or journalctl output
Unscheduled crashes or reboots on nodes participating in batman-adv mesh networks
Anomalous tp_meter ACK traffic targeting nodes that are not in the sender role

Detection Strategies

Enable kernel address sanitizer (KASAN) or KMSAN in test environments to surface uninitialized memory reads in the batman-adv module
Monitor dmesg and syslog telemetry for batman-adv subsystem errors and forward to a central log platform
Inspect batman-adv packet captures for ACK packets that do not correlate to an outbound sender session on the receiving node

Monitoring Recommendations

Aggregate kernel logs from mesh nodes to a centralized analytics platform and alert on batman-adv error patterns
Track installed kernel versions across the fleet and flag hosts running unpatched stable branches
Baseline normal tp_meter usage so that unsolicited ACK floods or role-mismatched packets stand out

How to Mitigate CVE-2026-52931

Immediate Actions Required

Update affected systems to a Linux kernel build that includes the upstream fix from the referenced stable commits
Disable the batman-adv module on hosts that do not require mesh networking using modprobe -r batman_adv and blacklist it
Restrict layer 2 access to the mesh so untrusted devices cannot inject crafted tp_meter packets

Patch Information

The fix is distributed across multiple stable branches as referenced kernel.org commits, including 0e388af0, 1a21c055, 53f931e0, 6c65cf23, 85397e48, 9884c9c0, dc2ae5fb, and ecdaa3e4. The patch adds a tp_vars->role check immediately after the session lookup and returns early when the role is not BATADV_TP_SENDER.

Workarounds

Unload and blacklist the batman_adv kernel module on hosts that do not need mesh routing
Apply link-layer access controls so only trusted peers can communicate over the mesh interface
Avoid initiating tp_meter sessions from untrusted peers until patched kernels are deployed

bash

# Disable and blacklist the batman-adv module until kernel is patched
sudo modprobe -r batman_adv
echo 'blacklist batman_adv' | sudo tee /etc/modprobe.d/blacklist-batman-adv.conf
sudo update-initramfs -u

# Verify the running kernel after upgrade
uname -r
modinfo batman_adv | grep -E '^(version|filename):'