CVE-2026-89951 Overview
CVE-2026-89951 is a use-after-free condition in the Linux kernel's batman-adv (B.A.T.M.A.N. Advanced) mesh networking subsystem. The flaw resides in the fragment reassembly logic, which reuses the socket buffer (skb) from the highest-numbered buffered fragment as the merged packet. When the underlying hard interface is removed before reassembly completes, the merged skb retains stale skb->dev and skb_iif references pointing to the freed net_device. Subsequent handlers such as Distributed ARP Table (DAT) and Bridge Loop Avoidance (BLA) derive ARP header length from skb->dev, dereferencing freed memory. An attacker on an adjacent network segment can trigger the condition through crafted fragmented mesh traffic.
Critical Impact
Adjacent-network attackers can trigger use-after-free of a freed net_device structure, enabling potential kernel memory corruption and code execution on hosts running batman-adv mesh interfaces.
Affected Products
- Linux kernel with batman-adv module enabled (multiple stable branches)
- Mesh networking deployments using B.A.T.M.A.N. Advanced
- Distributions shipping vulnerable kernels prior to the referenced stable commits
Discovery Timeline
- 2026-09-16 - CVE-2026-89951 published to the National Vulnerability Database
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-89951
Vulnerability Analysis
The batman-adv subsystem implements layer-2 mesh routing and supports fragmentation of large packets across mesh hops. During reassembly, the reassembly path selects the skb belonging to the highest-numbered buffered fragment and treats it as the merged packet container. That skb carries metadata about the receive device (skb->dev) and receive interface index (skb_iif) captured at ingress time.
When batadv_batman_skb_recv() reinjects the merged packet through the normal receive handlers, downstream consumers assume this metadata is still valid. The Distributed ARP Table (DAT) and Bridge Loop Avoidance (BLA) handlers both compute the ARP header length using skb->dev. If the originating hard interface was torn down between buffering and completion of the fragment chain, the net_device pointer becomes stale and any dereference reads freed kernel memory.
Root Cause
The root cause is a lifetime mismatch between buffered fragment skbs and their originating hard interface. The reassembly logic does not refresh device metadata when reinjecting the merged skb, so a net_device freed during interface teardown remains referenced through the merged packet's skb->dev field.
Attack Vector
Exploitation requires adjacent-network access to the mesh. An attacker sends fragmented batman-adv frames timed against the removal of a hard interface participating in the mesh. When reassembly completes after the interface is torn down, DAT or BLA processing triggers the use-after-free. The fix refreshes receive device metadata from the current receive device before invoking packet handlers, keeping reinjected merged fragments consistent with the normal receive path.
Refer to the upstream stable commits for the full patch series, including Linux Kernel Commit 2dffc8c and Linux Kernel Commit f830c2d.
Detection Methods for CVE-2026-89951
Indicators of Compromise
- Kernel oops or panic messages referencing batadv_batman_skb_recv, batadv_dat_*, or batadv_bla_* functions.
- KASAN reports flagging use-after-free on net_device structures during fragment reassembly.
- Unexpected batman-adv interface teardown events correlated with system crashes on mesh nodes.
Detection Strategies
- Enable Kernel Address Sanitizer (KASAN) on test kernels to surface use-after-free access during fragmented mesh traffic.
- Monitor kernel ring buffer (dmesg) for batman-adv warnings coinciding with hard interface removal.
- Audit installed kernel versions against the fixed stable commits listed in the vendor references.
Monitoring Recommendations
- Collect kernel crash dumps from mesh gateways and forward them to a centralized log platform for correlation.
- Track RTM_DELLINK netlink events on interfaces bound to batman-adv soft interfaces to detect teardown races.
- Alert on repeated fragmented traffic patterns arriving on mesh-facing interfaces from unauthorized peers.
How to Mitigate CVE-2026-89951
Immediate Actions Required
- Upgrade to a Linux kernel version that incorporates the batman-adv fragment reassembly fix from the referenced stable commits.
- Inventory hosts running the batman_adv module and prioritize patching mesh gateways and bridged nodes.
- Restrict physical and logical adjacency to trusted mesh participants until patches are deployed.
Patch Information
The fix refreshes skb->dev and skb_iif from the current receive device before running the packet handlers, ensuring internally reinjected merged fragments no longer reference a freed net_device. Apply the patch series published in the kernel stable tree: Commit 2dffc8c, Commit 63d8625, Commit 6df6482, Commit a2c272d, Commit ad46c90, Commit e91d2cc, Commit f4b4ae7, and Commit f830c2d.
Workarounds
- Unload the batman_adv kernel module on systems that do not require mesh networking (modprobe -r batman_adv).
- Avoid dynamic addition and removal of hard interfaces on active batman-adv soft interfaces until patched.
- Segment mesh-facing interfaces on isolated VLANs to limit adjacent-network exposure.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.