CVE-2026-31657

What it actually does

This is a Linux kernel use-after-free vulnerability in the batman-adv mesh networking subsystem, specifically in Bridge Loop Avoidance claim handling. A claim's backbone gateway pointer can be replaced and the old gateway reference released while other reader paths still dereference the stale pointer. Affected paths include netlink claim dumping and claim checking, which may access claim->backbone_gw->orig or claim->backbone_gw->crc_lock without first holding a stable reference. In practical terms, a remote, unauthenticated actor able to interact with an exposed batman-adv mesh interface may be able to trigger kernel memory corruption, causing a denial of service and, depending on kernel build, memory layout, hardening, and exploit reliability, potentially escalating to arbitrary kernel code execution.

Why it matters to the business

Systems using batman-adv for mesh networking may be vulnerable to remote kernel compromise or crashes. Successful exploitation could interrupt network availability, destabilize routers, gateways, appliances, or embedded Linux systems, and in a worst case allow an attacker to take control of the operating system. Although the EPSS score is currently low and there is no known CISA KEV listing or public exploit maturity reported, the CVSS severity is critical because exploitation requires no authentication or user interaction where the vulnerable feature is reachable. Organizations with wireless mesh, community network, IoT, industrial, lab, or embedded Linux deployments should prioritize inventory and patching of systems that load or expose the batman-adv kernel module.

How an attack unfolds

An attacker first identifies a Linux system participating in or reachable through a batman-adv mesh network with Bridge Loop Avoidance functionality in use. The attacker then sends crafted mesh/network activity that causes batadv_bla_add_claim() to replace a claim's backbone gateway while another path is reading the same claim through netlink claim dumping or claim validation. Because the reader does not pin the gateway object before following the pointer, the old gateway can be freed while still in use. The stale pointer is then dereferenced when accessing the gateway originator object or CRC lock, producing a kernel use-after-free. The most likely observable outcome is a kernel crash or panic; with a reliable heap-shaping technique and favorable kernel conditions, exploitation could potentially be developed into privileged kernel code execution.

How to fix it

Upgrade to a Linux kernel build from the relevant distribution or vendor that includes the batman-adv fix which holds claim backbone gateways by reference in the affected reader paths. No exact fixed version was provided in the input, so remediation should be based on vendor advisories for the deployed kernel branch. Where immediate patching is not possible, mitigate by disabling or unloading the batman-adv module if it is not required, preventing automatic module loading, disabling batman-adv interfaces, and restricting access to mesh segments to trusted systems only. Additional hardening measures include enabling kernel lockdown, KASLR, SMEP/SMAP where supported, panic-on-oops handling appropriate to operational needs, and strict network segmentation around mesh infrastructure. Because this is a kernel memory-safety issue, configuration-only mitigations should be treated as temporary unless batman-adv is fully disabled or unreachable.

How to confirm the fix worked

Confirm exposure by checking whether the running kernel includes the vendor patch and whether the batman-adv module is present or loaded. Validate the kernel package version against the distribution's security advisory rather than relying only on upstream version numbers. On Linux systems, check for loaded modules with commands such as lsmod | grep batman_adv, inspect /sys/module/batman_adv when present, and review active interfaces or tooling that indicates batman-adv participation. Confirm remediation by booting into the patched kernel, verifying that the old vulnerable kernel is not still running, and ensuring no unpatched fallback kernel remains the default boot option. If batman-adv is not required, confirm the module cannot be loaded and no batman-adv interfaces are active. In test environments, kernel debug tooling such as KASAN or syzkaller-style regression testing can be used to validate that the affected use-after-free path no longer triggers.

Typical attack path

1. Identify Linux systems, routers, gateways, appliances, or embedded devices using the batman-adv kernel module.
2. Gain network reachability to the relevant batman-adv mesh segment or interface.
3. Generate crafted batman-adv Bridge Loop Avoidance claim/gateway state changes to force claim->backbone_gw replacement.
4. Trigger concurrent claim-reading behavior, such as claim checks or netlink claim dump activity, while the old gateway object is being released.
5. Cause a stale backbone gateway pointer to be dereferenced after free.
6. Achieve denial of service through kernel crash, or attempt further exploitation for kernel-level code execution where feasible.

How to detect it

To determine whether exploitation was already attempted, collect kernel logs, persistent journal entries, crash dumps, netconsole output, and monitoring alerts from systems that load batman-adv. Search for kernel oops, panic, general protection fault, slab corruption, refcount, lock, RCU, or KASAN use-after-free messages that mention batman_adv, batadv_bla, claim handling, backbone gateways, or related functions. Review timestamps around unexplained reboots or watchdog resets on mesh nodes. If kernel crash dumps are available, inspect stack traces for batadv_bla_add_claim(), batadv_bla_check_claim(), netlink claim dump routines, or accesses involving backbone_gw. Network-level evidence may be limited because successful triggering can look like malformed or high-rate batman-adv mesh control activity rather than a conventional application-layer exploit. Baseline normal batman-adv traffic and investigate sudden claim churn, unusual gateway changes, repeated BLA claim activity, or mesh participants not expected in the environment. There are no known public exploit-specific payload signatures from the provided data, so detection should focus on vulnerable-feature exposure plus kernel fault artifacts.

• /sys/module/batman_adv
• batman_adv
• batman-adv
• batadv_bla_add_claim
• batadv_bla_check_claim
• batadv_bla_claim_get_backbone_gw
• backbone_gw
• claim->backbone_gw
• BUG: KASAN: use-after-free
• use-after-free in batadv
• general protection fault
• kernel BUG at
• Oops:
• Kernel panic
• slab-use-after-free
• refcount_t: underflow
• batadv
• BLA claim
• Bridge Loop Avoidance

What your security team should do

• Inventory Linux systems for batman-adv usage, prioritizing routers, gateways, mesh nodes, wireless infrastructure, embedded devices, and appliances.
• Patch affected systems to a vendor kernel containing the batman-adv reference-lifetime fix; reboot where required to ensure the patched kernel is active.
• If batman-adv is not business-critical, disable or blacklist the batman_adv kernel module and remove related interface configuration.
• Restrict access to batman-adv mesh networks and management interfaces to trusted nodes only; avoid exposing mesh participation to untrusted networks.
• Review kernel logs for crashes, use-after-free warnings, KASAN reports, or batman-adv anomalies that may indicate attempted triggering.
• Monitor vendor advisories for exact fixed kernel versions because the input did not provide fixed-version mappings.
• Treat unexplained crashes on batman-adv nodes as potentially security-relevant until logs and memory-corruption evidence are reviewed.