CVE-2025-21781

What it actually does

Race condition in batman-adv allows a hard interface to be disassociated from its soft interface before a pending batadv_v_elp_throughput_metric_update work item completes, resulting in use-after-free and kernel panic during interface removal or reboot.

Why it matters to the business

Unexpected kernel crashes on systems using batman-adv for wireless mesh networking can cause service outages, reboot loops, and operational disruption, especially in environments that frequently manage network interfaces.

How an attack unfolds

An attacker or automated process triggers hard interface removal (for example via network configuration change or reboot) while a delayed metric update work item is queued; the work then executes after the soft interface association is gone, dereferencing freed memory and crashing the kernel.

How to fix it

Upgrade the Linux kernel to a version containing commit 167422a07096a6006599067c8b55884064fa0b72 or later stable releases that include the reference-counting fix for batadv_hardif_neigh_node and batadv_hard_iface.

How to confirm the fix worked

Verify the running kernel contains commit 167422a07096a6006599067c8b55884064fa0b72; confirm absence of the panic call trace involving batadv_v_elp_throughput_metric_update after interface removal operations.

Typical attack path

1. Obtain local or network-adjacent access sufficient to trigger interface removal or reboot
2. Ensure a batadv_hardif_neigh_node metric_work item is queued or delayed
3. Perform hard interface removal while the work item is still pending
4. Work handler executes after soft_iface association is cleared, causing panic in batadv_v_elp_throughput_metric_update

How to detect it

Search kernel logs and crash dumps for the call trace containing batadv_v_mesh_free, batadv_v_elp_throughput_metric_update, and worker_thread; look for repeated panics coinciding with interface removal events.

• batadv_v_elp_throughput_metric_update+0x1c/0xa4
• batadv_v_mesh_free+0xd0/0x4dc [batman_adv]
• hardif_neigh->bat_v.metric_work
• process_one_work+0x178/0x398

What your security team should do

• Apply the referenced kernel commit or updated distribution packages immediately on all systems using batman-adv
• Prioritize patching in environments that perform frequent interface changes or automated reboots
• Monitor kernel logs for batadv-related panics until patches are deployed