CVE-2026-89948: Linux Kernel BLA Privilege Escalation Flaw

CVE-2026-89948 Overview

CVE-2026-89948 is a Linux kernel vulnerability in the batman-adv (B.A.T.M.A.N. Advanced) mesh routing module. The flaw resides in the Bridge Loop Avoidance (BLA) subsystem and affects how claims are freed when a mesh interface is deleted. The function batadv_bla_del_backbone_claims(), reachable via batadv_bla_purge_backbone_gw(), is intended to remove all claims during teardown. However, batadv_bla_free() always sets bat_priv->bla.claim_hash to NULL before the cleanup runs, preventing the code path from executing. Kernel maintainers merged patches across multiple stable branches.

Critical Impact
Improper cleanup of BLA claims during mesh interface deletion can leave stale entries in kernel memory, causing resource management issues in batman-adv mesh deployments.

Affected Products

Linux kernel (upstream) with the batman-adv module compiled or loaded
Distributions shipping vulnerable stable branches referenced by the kernel git commits
Systems running mesh networking with Bridge Loop Avoidance enabled

Discovery Timeline

2026-09-16 - CVE-2026-89948 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-89948

Vulnerability Analysis

The batman-adv module implements Bridge Loop Avoidance to prevent loops when multiple gateways bridge the same LAN into a mesh. Each backbone gateway tracks client MAC address ownership via claim entries stored in bat_priv->bla.claim_hash.

On mesh interface deletion, the intended cleanup path calls batadv_bla_purge_backbone_gw(), which in turn calls batadv_bla_del_backbone_claims() to remove all claims. This path executes only when bat_priv->bla.claim_hash is not NULL. batadv_bla_free() unconditionally sets that pointer to NULL before the cleanup logic runs, so the claim purge never fires.

A secondary problem exists in batadv_bla_purge_claims() -> batadv_handle_unclaim(). The BLA code does not handle rehashing in batadv_bla_update_orig_address(). The stored backbone address may not match the value originally used for hash bucket selection, so batadv_handle_unclaim() can fail to locate the matching backbone and abort the deletion.

Root Cause

The root cause is an ordering defect combined with a fragile dependency on backbone lookup during unclaim. Setting claim_hash to NULL before purge logic runs makes the purge unreachable. The unclaim handler also relies on backbone address resolution that is not stable across rehashing. The fix removes the unnecessary backbone_gw existence check inside batadv_handle_unclaim() because all required information is provided by the caller.

Attack Vector

This is a kernel-internal resource cleanup defect triggered by administrative teardown of a mesh interface. No specific network attack vector is documented in the advisory. Impact is limited to systems running batman-adv with BLA active. Exploitation prerequisites and remote reachability are not defined in the published CVE data.

// No verified proof-of-concept code is available.
// See the kernel git commits referenced below for the applied fixes.

Detection Methods for CVE-2026-89948

Indicators of Compromise

No specific indicators of compromise are published for this cleanup defect
Anomalous kernel memory growth on hosts that repeatedly create and destroy batman-adv mesh interfaces
Kernel log entries referencing batman-adv BLA operations during interface teardown

Detection Strategies

Inventory Linux hosts with the batman-adv module loaded using lsmod | grep batman_adv
Compare running kernel versions against the fixed commits published on git.kernel.org stable branches
Correlate kernel package versions with distribution security advisories tracking CVE-2026-89948

Monitoring Recommendations

Monitor kernel version drift across mesh nodes and edge devices that use batman-adv
Track patch state for stable kernels referenced in the kernel git commits linked in this advisory
Alert on unexpected loading of the batman_adv kernel module on hosts where it is not required

How to Mitigate CVE-2026-89948

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the kernel git commits for this CVE
Update to a distribution kernel that includes the corrected batadv_bla_del_backbone_claims() and batadv_handle_unclaim() logic
Reboot affected hosts after installing the patched kernel to load the corrected module

Patch Information

Fixes are available in the upstream Linux kernel via multiple stable-branch commits, including Kernel Git Commit e9b7e4b, Kernel Git Commit 300d2a2, Kernel Git Commit d24f1ef, Kernel Git Commit 2516cfb, Kernel Git Commit 23e3472, Kernel Git Commit 3618192, Kernel Git Commit c1a1599, and Kernel Git Commit 84e3290.

Workarounds

Unload the batman_adv module on systems that do not require mesh routing using modprobe -r batman_adv
Disable Bridge Loop Avoidance on affected mesh interfaces where operationally acceptable
Restrict mesh interface teardown operations to reduce exposure to the defective cleanup path until patches are applied

bash

# Verify running kernel version and batman-adv module state
uname -r
lsmod | grep batman_adv
modinfo batman_adv | grep -E 'version|filename'