CVE-2026-43382

What it actually does

This is a local denial-of-service flaw in the Linux kernel batman-adv subsystem. The vulnerable code path can attempt to acquire the RTNL networking lock while that lock is already held, specifically during ELP throughput metric handling on cfg80211-backed wireless interfaces. Under the right timing, cancellation of the delayed ELP metric worker can deadlock the kernel networking stack, causing affected networking operations to hang and potentially making the system partially or fully unavailable. The issue does not provide confidentiality or integrity impact, but it can cause high availability impact on systems using batman-adv.

Why it matters to the business

Systems that rely on batman-adv mesh networking, especially wireless mesh or embedded Linux deployments, may become unavailable or lose network connectivity if a local user or local workload can trigger the vulnerable path. The risk is lower for general-purpose Linux servers that do not load or use batman-adv, and current exploitation signals are low: EPSS is 0.00095, it is not in CISA KEV, it is not known to be used in ransomware campaigns, and no public exploit maturity is reported. However, for appliances, routers, IoT gateways, mesh nodes, and field devices that depend on batman-adv, the operational impact can be significant because a deadlocked networking subsystem may require service restart or reboot to recover.

How an attack unfolds

An attacker first needs local access to an affected Linux system, either as an authenticated local user, a compromised low-privilege process, or code running inside a context that can interact with the relevant networking interfaces. The system must have the batman-adv functionality available and configured in a way that exercises the ELP throughput metric worker, particularly with cfg80211-related wireless interfaces. The attacker then triggers interface state changes or networking operations that cause batadv_v_elp_get_throughput() and batadv_v_elp_iface_disable() to interact while the RTNL lock is already held. On vulnerable kernels, the code can call a helper that also tries to take the RTNL lock, creating a self-deadlock. Once the deadlock occurs, affected networking operations may stall indefinitely, degrading or interrupting service until the condition is cleared, commonly by rebooting or otherwise resetting the affected networking components.

How to fix it

Apply a Linux kernel update that includes the batman-adv fix changing the vulnerable path to use the lockless real-netdev lookup behavior when the RTNL lock may already be held. No exact fixed package versions were provided in the input, so use your distribution vendor’s advisory and kernel package changelog to identify the corrected build for CVE-2026-43382. Where immediate patching is not possible, reduce exposure by disabling or unloading batman-adv where it is not required, preventing untrusted local users or workloads from managing network interfaces, and limiting access to devices that rely on wireless mesh networking. Avoid treating module unload as a universal mitigation on production systems because removing active network modules can disrupt connectivity; validate in maintenance windows first.

How to confirm the fix worked

Confirm remediation by verifying that the running kernel version matches a vendor build that contains the batman-adv RTNL deadlock fix. Check package manager advisory metadata, kernel changelogs, or source patches for references to batman-adv, ELP metric worker locking, rtnl_trylock(), and __batadv_get_real_netdev(). Validate exposure by checking whether the batman-adv module is loaded or built in and whether batman-adv interfaces are configured. On Linux systems, useful checks include reviewing `uname -a`, installed kernel package versions, `lsmod | grep batman`, `/sys/module/batman_adv`, `ip link show type batadv`, and distribution-specific security advisory tooling. After patching, reboot into the fixed kernel and verify the old vulnerable kernel is not still running.

Typical attack path

1. Gain local execution or low-privileged access on a Linux system that has batman-adv enabled or loaded.
2. Identify or create conditions involving batman-adv ELP metric processing on a cfg80211-backed wireless interface.
3. Trigger interface disable, teardown, or state-change activity while the ELP metric worker is active.
4. Cause the vulnerable code path to attempt nested RTNL lock acquisition.
5. Induce a kernel networking deadlock that disrupts network availability or requires administrative recovery.

How to detect it

Look for evidence of availability disruption rather than data theft. Relevant sources include kernel logs, system journal, dmesg, netlink/network-manager logs, wireless interface management logs, watchdog alerts, and uptime/reboot telemetry. Search for batman-adv messages around the time of network hangs, interface disable events, cfg80211 or wireless interface state changes, blocked kernel tasks, hung workqueues, and processes stuck waiting on RTNL or network configuration operations. Also review local authentication and command execution logs for users or processes repeatedly manipulating batman-adv or wireless interfaces with tools such as ip, batctl, iw, ifconfig, NetworkManager, or systemd-networkd. Since the flaw causes a deadlock and not a distinctive payload execution pattern, the absence of a unique IOC does not rule out exploitation; correlate suspicious local activity with sudden loss of networking or watchdog-triggered recovery.

• batman_adv
• batadv
• batadv_v_elp_get_throughput
• batadv_v_elp_iface_disable
• rtnl_lock
• RTNL
• cfg80211
• blocked for more than 120 seconds
• INFO: task
• hung task
• workqueue
• cancel_delayed_work_sync
• ip link set
• batctl
• /sys/module/batman_adv
• /sys/class/net/bat

What your security team should do

• Prioritize patching systems that actively use batman-adv for mesh networking, wireless backhaul, embedded routing, IoT gateways, or field connectivity.
• Inventory Linux assets for loaded or configured batman-adv support using module, sysfs, and network interface checks.
• Use vendor kernel advisories to identify the first fixed kernel package for each distribution and ensure systems are rebooted into the fixed kernel after update.
• If patching is delayed, disable batman-adv on systems where it is not operationally required and restrict local shell, container, and service accounts from making network configuration changes.
• Monitor affected systems for unexplained network hangs, blocked RTNL operations, kernel workqueue stalls, or watchdog reports that may indicate attempted exploitation or accidental triggering.
• Because this is not currently KEV-listed, not known ransomware-used, and has very low EPSS, schedule broad enterprise remediation according to normal kernel maintenance while expediting exposed mesh-networking devices.