CVE-2026-89950: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-89950 Overview

CVE-2026-89950 affects the Linux kernel's batman-adv mesh networking module. The flaw resides in the multicast forwarding path, where the functions batadv_mcast_forw_packet() and batadv_mcast_forw_scrape() operate on socket buffers (SKBs) that are not guaranteed to be linearized. When these functions are reached through batadv_mcast_forw_mcsend(), the SKB_LINEAR_ASSERT() macro triggers a fatal kernel BUG(). The condition is reachable during the initial forwarding-mode selection in batadv_mcast_forw_mode(), causing a denial of service on the affected node.

Critical Impact
A local or adjacent attacker on a batman-adv mesh network can trigger a kernel BUG(), causing a denial of service on the affected host.

Affected Products

Linux kernel — batman-adv (B.A.T.M.A.N. advanced) multicast subsystem
Kernel branches referenced by the upstream stable commits 28791775, 6a30a59e, a9603e0a, and c32e5e25
Distributions shipping vulnerable kernels with CONFIG_BATMAN_ADV enabled

Discovery Timeline

2026-09-16 - CVE-2026-89950 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-89950

Vulnerability Analysis

The batman-adv module implements a Layer 2 mesh routing protocol in the Linux kernel. Its multicast forwarding path relies on the SKB being linearized before helper functions inspect and modify packet contents.

batadv_recv_mcast_packet() unshares and linearizes SKBs before invoking downstream helpers. However, the transmit path reaches the same helpers through a different chain: batadv_interface_tx → batadv_mcast_forw_mode → batadv_mcast_forw_mode_by_count() → batadv_mcast_forw_push() → batadv_mcast_forw_scrape(). On this transmit path, the SKB is unshared but not linearized.

When batadv_mcast_forw_scrape() executes SKB_LINEAR_ASSERT() on a non-linear SKB, the assertion fires and the kernel calls BUG(). This halts the CPU context and produces a kernel oops, resulting in denial of service.

Root Cause

The root cause is a missing linearization step on the multicast transmit path. The helper functions assume a precondition established only by the receive path. The upstream fix moves linearization into batadv_mcast_forw_expand_head() so both call sites satisfy the assertion before packet manipulation begins.

Attack Vector

Exploitation requires the ability to influence multicast traffic processed by a batman-adv interface. An attacker on the mesh, or a local user able to inject multicast frames through a batman-adv soft interface, can craft SKBs that reach the transmit path in a non-linear state. Refer to the upstream commits 28791775, 6a30a59e, a9603e0a, and c32e5e25 for the precise code path.

No public proof-of-concept exploit is available. The condition is described in prose only; no verified exploitation code has been released.

Detection Methods for CVE-2026-89950

Indicators of Compromise

Kernel panic or BUG() messages referencing batadv_mcast_forw_scrape or batadv_mcast_forw_packet in dmesg or /var/log/kern.log.
Unexpected reboots or SKB_LINEAR_ASSERT warnings on hosts participating in a batman-adv mesh.
Repeated crash-loop signatures on mesh routers or IoT gateways using batman-adv.

Detection Strategies

Monitor kernel ring buffer output for stack traces containing batadv_mcast_forw_* symbols.
Correlate host crash events with batman-adv interface activity and multicast traffic volume.
Inventory hosts where CONFIG_BATMAN_ADV is compiled and the batman-adv module is loaded (lsmod | grep batman_adv).

Monitoring Recommendations

Ship kernel logs to a central log platform and alert on BUG: or kernel panic events tied to batman-adv.
Track running kernel versions against the fixed stable releases referenced by the upstream commits.
Watch for anomalous multicast traffic patterns entering mesh interfaces from untrusted peers.

How to Mitigate CVE-2026-89950

Immediate Actions Required

Apply the upstream stable kernel updates that include the linearization fix in batadv_mcast_forw_expand_head().
Identify hosts running batman-adv and prioritize patching mesh nodes exposed to untrusted peers.
Restart affected systems after patching to load the fixed kernel image.

Patch Information

The fix is contained in the upstream Linux kernel commits 28791775, 6a30a59e, a9603e0a, and c32e5e25. Apply distribution kernel updates that incorporate these commits.

Workarounds

Unload the batman-adv module on hosts that do not require mesh networking: modprobe -r batman_adv.
Blacklist the module via /etc/modprobe.d/ where mesh functionality is unused.
Restrict mesh membership to trusted peers and segment mesh interfaces from untrusted networks until patched.

bash

# Disable batman-adv where mesh networking is not needed
echo "blacklist batman_adv" | sudo tee /etc/modprobe.d/blacklist-batman-adv.conf
sudo modprobe -r batman_adv