CVE-2026-63834: Linux Kernel batman-adv DoS Vulnerability

CVE-2026-63834 Overview

CVE-2026-63834 affects the Linux kernel's batman-adv (Better Approach To Mobile Ad-hoc Networking) module, specifically the throughput meter (tp_meter) subsystem. The vulnerability stems from an unbounded unacked_list data structure. An attacker can send crafted messages with small payloads and manipulated sequence numbers containing gaps, forcing the receiver to continuously allocate new unacked_list entries. The condition leads to memory exhaustion or excessive CPU consumption as the kernel searches through the growing list. Upstream maintainers resolved the issue by capping the list size and dropping the highest-seqno entry when the limit is exceeded, allowing earlier sequence numbers to progress through batadv_tp_ack_unordered().

Critical Impact
Remote attackers on the mesh network can trigger kernel memory exhaustion or sustained CPU degradation on affected Linux systems using batman-adv throughput meter functionality.

Affected Products

Linux kernel builds with the batman-adv module compiled and loaded
Systems participating in B.A.T.M.A.N. mesh networks using tp_meter
Multiple stable kernel branches fixed via the referenced commits

Discovery Timeline

2026-07-19 - CVE-2026-63834 published to NVD
2026-07-19 - Last updated in NVD database

Technical Details for CVE-2026-63834

Vulnerability Analysis

The batman-adv throughput meter tracks acknowledgements for measured packets using an internal unacked_list. Under normal operation, entries are inserted when packets are transmitted and removed when the corresponding acknowledgement is received. The list has no size cap in the vulnerable code path. This is a resource exhaustion (Denial of Service) condition in a kernel networking module, so successful exploitation impacts availability of the host and, in mesh deployments, the neighboring nodes that rely on it.

Root Cause

The root cause is missing bounds enforcement on the unacked_list inside the batman-adv tp_meter receive path. When an attacker transmits packets with sequence numbers containing deliberate gaps, batadv_tp_ack_unordered() cannot advance the acknowledgement window. Each out-of-order small-length packet triggers a new allocation appended to the list. Without an upper bound, the list grows linearly with attacker input, consuming kernel memory and increasing search cost for every subsequent insertion or lookup.

Attack Vector

An attacker with the ability to send frames to a batman-adv peer running a tp_meter session can inject a stream of small packets with skewed sequence numbers. Because batman-adv operates at Layer 2 across a mesh, the attacker must be reachable on the mesh fabric rather than the broader internet. Sustained injection either exhausts kernel memory, resulting in out-of-memory conditions, or wastes significant CPU cycles traversing an oversized list. The patched code enforces a maximum list length and drops the entry with the highest sequence number when the cap is exceeded, allowing legitimate lower-seqno acknowledgements to complete.

No verified proof-of-concept code is publicly available. The vulnerability mechanism is documented in the upstream commit messages referenced by the Linux kernel maintainers.

Detection Methods for CVE-2026-63834

Indicators of Compromise

Sustained growth of kernel slab allocations attributed to batman-adv structures without corresponding release
Elevated softirq or kernel CPU utilization on nodes running active tp_meter sessions
Kernel logs reporting out-of-memory (OOM) events on systems with batman-adv loaded
Abnormal volume of small-length batman-adv frames with non-contiguous sequence numbers on the mesh interface

Detection Strategies

Monitor /proc/slabinfo and per-module memory counters for anomalous growth associated with batman-adv
Correlate dmesg output with active tp_meter sessions to identify pathological unacknowledged sequence patterns
Capture mesh traffic with tcpdump on the batman interface and inspect sequence number distribution during suspected incidents

Monitoring Recommendations

Alert on Linux kernel OOM-killer invocations on hosts participating in batman-adv meshes
Track CPU time attributed to batadv_* kernel symbols using perf or bpftrace
Baseline tp_meter session frequency and flag deviations that coincide with resource pressure

How to Mitigate CVE-2026-63834

Immediate Actions Required

Update to a Linux kernel release containing the fix commits referenced by the upstream advisory
Unload the batman-adv module on hosts that do not require mesh networking using modprobe -r batman_adv
Restrict who can initiate tp_meter sessions and limit mesh membership to trusted nodes

Patch Information

The fix is available in multiple Linux stable branches through the following commits: Linux Kernel Commit 1111a33, Linux Kernel Commit 1c616b0, Linux Kernel Commit 1fb8762, Linux Kernel Commit 2233787, Linux Kernel Commit 31a8879, Linux Kernel Commit c6231d6, Linux Kernel Commit e7c7751, and Linux Kernel Commit f8c499f. The patches introduce an upper bound on unacked_list entries and drop the highest-seqno element when the limit is reached.

Workarounds

Blacklist the batman_adv kernel module on systems that do not participate in mesh networking
Segment mesh networks to allow only authenticated, trusted peers to send tp_meter traffic
Apply resource controls (cgroup memory limits) to constrain the blast radius of kernel resource exhaustion where feasible

bash

# Configuration example
# Disable batman-adv on hosts that do not require mesh networking
echo 'blacklist batman_adv' | sudo tee /etc/modprobe.d/blacklist-batman-adv.conf
sudo modprobe -r batman_adv

# Verify module status
lsmod | grep batman_adv