CVE-2026-63836: Linux Kernel batman-adv DOS Vulnerability

CVE-2026-63836 Overview

CVE-2026-63836 is a divide-by-zero vulnerability in the Linux kernel's batman-adv (B.A.T.M.A.N. Advanced) mesh networking module. The flaw resides in the throughput meter (tp_meter) subsystem, specifically within the batadv_tp_update_cwnd() congestion window update function. When the congestion window (cwnd) reaches its maximum value of 0x20000000, an unsigned 32-bit arithmetic overflow causes the divisor to wrap around to zero. The resulting division by zero triggers a kernel-level fault.

Critical Impact
A local user able to trigger batman-adv throughput measurement operations can cause a kernel divide-by-zero condition, leading to denial of service on affected Linux systems.

Affected Products

Linux kernel versions containing the batman-adv module prior to the fix commits
Systems using B.A.T.M.A.N. Advanced mesh networking protocol
Distributions shipping the vulnerable batadv_tp_update_cwnd() implementation

Discovery Timeline

2026-07-19 - CVE-2026-63836 published to NVD
2026-07-19 - Last updated in NVD database

Technical Details for CVE-2026-63836

Vulnerability Analysis

The vulnerability stems from unsafe unsigned 32-bit arithmetic in the batman-adv throughput meter congestion window calculation. The original code computes ((mss * 8) ** 2) / (cwnd * 8) to derive the congestion window decrement value. This calculation preserves precision through scaling but introduces an overflow condition at the boundary of the valid cwnd range.

The cwnd variable is constrained to the range MSS <= cwnd <= 0x20000000. When cwnd equals its maximum value of 0x20000000, the expression cwnd * 8 shifts left by three bits. The result becomes 0x100000000, which exceeds U32_MAX. The value wraps to zero within the 32-bit register, producing a divide-by-zero condition in the kernel.

The fix restructures the expression to (mss ** 2) * 8 / cwnd, eliminating the multiplication of the divisor while retaining the scaling factor for precision. This change keeps the divisor within safe bounds for all valid cwnd values.

Root Cause

The root cause is an integer overflow [CWE-190] in the divisor of an arithmetic expression, which produces a divide-by-zero fault [CWE-369]. Kernel developers assumed the intermediate multiplication cwnd * 8 would remain within 32-bit bounds, but the maximum permitted cwnd value exceeds this limit after the shift operation.

Attack Vector

An attacker with the ability to interact with the batman-adv interface can trigger the throughput measurement path through batadv_tp_recv_ack(). Reaching the maximum congestion window state causes batadv_tp_update_cwnd() to execute the flawed division. The resulting kernel fault produces a denial of service. The vulnerability requires access to the mesh networking stack, limiting exploitation to attackers with network adjacency or local access to the batman-adv interface.

The vulnerability manifests in the congestion window update logic within the batman-adv throughput meter. See the referenced kernel commits for the specific code changes that address the overflow.

Detection Methods for CVE-2026-63836

Indicators of Compromise

Kernel panic or divide-by-zero fault entries in dmesg or /var/log/kern.log referencing batadv_tp_update_cwnd
Unexpected reboots or crashes on systems running batman-adv mesh networking
Abnormal termination of tp_meter throughput measurement sessions between mesh peers

Detection Strategies

Inspect running kernel version against the fixed commits listed in the kernel Git references to identify unpatched hosts
Monitor kernel crash dumps for stack traces containing batadv_tp_update_cwnd or batadv_tp_recv_ack symbols
Audit systems for the presence of the batman-adv module using lsmod | grep batman_adv and correlate with kernel version data

Monitoring Recommendations

Enable kdump or equivalent kernel crash collection to capture divide-by-zero exceptions for forensic review
Alert on repeated kernel oops events on hosts using mesh networking to catch exploitation attempts
Track batman-adv interface state changes and unexpected tp_meter session activity in system logs

How to Mitigate CVE-2026-63836

Immediate Actions Required

Update the Linux kernel to a version containing one of the fix commits: 1381b02, 33ccd52, 35264c4, 585616d, 7d2a44b, ac229c8, cd74176, or d08b69d
Identify all hosts loading the batman-adv kernel module and prioritize patching
Restrict access to mesh networking interfaces on systems that cannot be immediately updated

Patch Information

The upstream Linux kernel maintainers have merged the fix across multiple stable branches. The patch replaces the vulnerable expression ((mss * 8) ** 2) / (cwnd * 8) with (mss ** 2) * 8 / cwnd in batadv_tp_update_cwnd(). Refer to the Kernel Git Commit 1381b02 for the canonical patch and the additional commits above for backports.

Workarounds

Unload the batman-adv module with modprobe -r batman_adv on systems that do not require mesh networking
Blacklist the batman-adv module by adding blacklist batman-adv to /etc/modprobe.d/ configuration files
Limit exposure of mesh networking interfaces to trusted peers only through firewall or network segmentation

bash

# Configuration example
# Blacklist the batman-adv module to prevent loading
echo "blacklist batman-adv" | sudo tee /etc/modprobe.d/disable-batman-adv.conf
sudo modprobe -r batman_adv

# Verify the module is not loaded
lsmod | grep batman_adv