CVE-2021-47482

What it actually does

Improper error handling in batadv_mesh_init allows batadv_mesh_free to be invoked on uninitialized fields, resulting in double-free attempts, ODEBUG warnings, and potential null-pointer dereferences or general protection faults during subsequent operations such as batadv_nc_purge_paths.

Why it matters to the business

Linux systems using the batman-adv module may experience kernel crashes or denial-of-service conditions during module initialization failures, leading to network instability in affected environments; low EPSS and absence from KEV indicate limited real-world exploitation pressure despite the 880-day exposure window.

How an attack unfolds

An attacker triggers failure in one of the batadv_*_init calls so that the flawed error path invokes cleanup routines on partially initialized structures, causing memory corruption or invalid pointer access without requiring network packets or elevated privileges beyond local interaction.

How to fix it

Apply the upstream fix that replaces the single batadv_mesh_free call with ordered per-subsystem unwind on error; rebuild and deploy the patched kernel; no downstream fixed versions are specified so upgrade to any kernel containing commit resolving the error-handling path.

How to confirm the fix worked

Boot the updated kernel and exercise batadv_mesh_init failure paths under syzkaller or similar fuzzing to confirm absence of ODEBUG warnings and GPFs; verify the ordered unwind logic is present in the batadv source.

Typical attack path

1. Load or initialize the batman-adv kernel module
2. Force a failure in one of the batadv_*_init subroutines
3. Trigger the erroneous batadv_mesh_free call on uninitialized state
4. Induce follow-on operations that dereference freed or null structures

How to detect it

Review kernel logs for ODEBUG warnings referencing batadv_nc_mesh_free, general protection faults in batadv_nc_purge_paths, or stack traces showing partial initialization of bat_priv structures; correlate with module load events.

What your security team should do

• Prioritize patching Linux kernels that include batman-adv on any system where the module may be loaded
• Monitor for kernel oops or ODEBUG reports involving batadv_nc_mesh_free or batadv_nc_purge_paths
• Disable batman-adv if not required to reduce attack surface until patched