CVE-2021-47252

What it actually does

The flaw involves incorrect use of WARN_ON for a non-bug timing condition in batman-adv OGM queuing, where the soft interface can change between queueing and worker transmission, producing spurious kernel warnings instead of standard logging.

Why it matters to the business

Unnecessary kernel warning messages may fill logs in mesh networks using batman-adv, complicating diagnostics with minimal operational disruption or availability risk.

How an attack unfolds

No practical exploitation path exists; the condition is a normal timing race rather than a security-relevant bug, and no public exploits or threat actor activity have been observed.

How to fix it

Apply the upstream kernel patch that replaces the WARN_ON with pr_warn in the batman-adv OGM transmission path; update to a Linux kernel version containing commit resolving CVE-2021-47252.

How to confirm the fix worked

Inspect batman-adv source for replacement of WARN_ON with pr_warn around OGM worker transmission logic and confirm absence of the timing-related assertion.

Typical attack path

1. Identify a batman-adv mesh node running the affected kernel
2. Trigger repeated OGM transmissions under interface change conditions
3. Observe resulting WARN_ON output in kernel logs

How to detect it

Search kernel logs (dmesg, syslog, journalctl) for batman-adv related WARN_ON messages tied to OGM interface changes; no ransomware or APT indicators are associated.

What your security team should do

• Prioritize kernel updates for systems running batman-adv in production mesh environments
• Review kernel logs for batman-adv WARN_ON entries as part of routine monitoring
• Track EPSS and KEV updates given the 882 days since publication