CVE-2026-63835: Linux Kernel Batman-adv DoS Vulnerability

CVE-2026-63835 Overview

CVE-2026-63835 is a Linux kernel vulnerability in the batman-adv mesh networking module. The flaw affects the B.A.T.M.A.N. Advanced protocol version V implementation. When a hard interface is disabled, batadv_hardif_disable_interface() calls batadv_v_ogm_iface_disable() which frees the aggr_list of Originator Message (OGM) socket buffers. However, batadv_v_ogm_send_meshif() can concurrently queue new skbs onto the freed aggr_list via batadv_v_ogm_queue_on_if(). The queued buffers are never consumed by batadv_v_ogm_aggr_work and are leaked, leading to resource exhaustion on affected systems.

Critical Impact
Concurrent interface teardown and OGM transmission produce a race condition that leaks kernel socket buffers, degrading system stability on hosts using batman-adv mesh routing.

Affected Products

Linux kernel with the batman-adv module compiled and enabled
Systems running B.A.T.M.A.N. Advanced protocol version V
Mesh networking deployments that dynamically enable and disable hard interfaces

Discovery Timeline

2026-07-19 - CVE-2026-63835 published to NVD
2026-07-19 - Last updated in NVD database

Technical Details for CVE-2026-63835

Vulnerability Analysis

The defect is a race condition [CWE-362] in the batman-adv OGM aggregation path. The batman-adv module transmits routing beacons called Originator Messages that are batched into an aggregation list per hard interface. When an operator disables a hard interface, the module tears down the aggregation worker and frees any pending buffers in aggr_list. This teardown is not synchronized with concurrent senders on other CPUs.

Another CPU executing batadv_v_ogm_send_meshif() can traverse the RCU-protected hard interface list and reach batadv_v_ogm_queue_on_if() after the disable path has already emptied aggr_list. The sender then appends fresh skbs to a list that will never be drained. Because batadv_v_ogm_aggr_work has been cancelled, the queued buffers remain allocated for the lifetime of the interface object.

Root Cause

The root cause is missing synchronization between batadv_v_ogm_iface_disable() and batadv_v_ogm_queue_on_if(). The disable routine does not block new queuers after freeing the aggregation list, and the RCU grace period on the hard interface list is not sufficient to prevent late arrivals. The upstream fix introduces a barrier in batadv_v_ogm_iface_disable() that prevents any further enqueue into aggr_list once teardown has begun.

Attack Vector

Triggering the condition requires local activity that toggles hard interfaces while OGM traffic is being generated. An unprivileged mesh workload combined with administrative interface flapping produces the race. Repeated exercise of the code path accumulates leaked skbs, eventually exhausting kernel memory reserved for network buffers. The vulnerability does not provide code execution or privilege escalation, but it degrades availability on long-running mesh nodes.

The fix is distributed across multiple stable kernel commits, including 3d4548c9, 86ab6b6f, 97644fda, d11c00b9, d3569327, d462ced7, f04dde74, and f79deaaf. See the Linux Kernel Commit for the reference change.

Detection Methods for CVE-2026-63835

Indicators of Compromise

Growing kmalloc and SLAB accounting for skbuff_head_cache on hosts running batman-adv
Repeated ip link set <iface> down or batctl if del operations coinciding with active mesh traffic
Kernel memory pressure warnings on mesh gateways without a corresponding workload increase

Detection Strategies

Monitor /proc/slabinfo for anomalous growth of skbuff_head_cache and skbuff_fclone_cache entries on batman-adv nodes
Correlate batman-adv interface state changes from dmesg with process listings that generate mesh traffic
Track kernel version and module fingerprint across mesh fleets to identify hosts running unpatched batman-adv builds

Monitoring Recommendations

Alert on unexpected MemAvailable decline on nodes where batman-adv is the primary networking module
Log administrative operations that add or remove hard interfaces from a bat0 device
Capture perf or bpftrace traces of batadv_v_ogm_queue_on_if invocations during interface teardown windows

How to Mitigate CVE-2026-63835

Immediate Actions Required

Update to a Linux kernel release that includes the batman-adv fix commits listed in the NVD references
Inventory all hosts that load the batman_adv module using lsmod and prioritize mesh gateways for patching
Avoid rapid enable/disable cycles of hard interfaces attached to bat0 on unpatched kernels

Patch Information

The fix is merged across stable trees in commits 3d4548c9, 86ab6b6f, 97644fda, d11c00b9, d3569327, d462ced7, f04dde74, and f79deaaf. Distribution kernels should pull the corresponding backports. Refer to the Linux Kernel Commit history for the full patch set.

Workarounds

Unload the batman_adv module on hosts that do not require mesh routing using modprobe -r batman_adv
Restrict administrative access to batctl and interface management commands to reduce operational triggering
Schedule interface reconfiguration only during maintenance windows with no active mesh peers

bash

# Verify running kernel and batman-adv module status
uname -r
lsmod | grep batman_adv
modinfo batman_adv | grep -E 'version|srcversion'

# Unload the module on hosts that do not need mesh routing
sudo modprobe -r batman_adv