CVE-2026-46206

What it actually does

This is a Linux kernel race condition in the batman-adv mesh networking subsystem. During mesh interface teardown, the vulnerable code can still allow new tp_meter sender or receiver sessions to start after the mesh state is no longer active. Racing teardown with session creation can leave kernel objects in an inconsistent lifetime state, potentially causing memory corruption, use-after-free-style behavior, kernel crashes, or, in the worst case reflected by the CVSS impact, local privilege escalation with kernel-level code execution.

Why it matters to the business

Systems that load or use the batman-adv kernel module could be exposed to local attackers who already have some level of access. Successful exploitation could allow takeover of the affected host, disruption through kernel panic or networking failure, or tampering with data and system configuration. The vulnerability is not currently listed in CISA KEV, has low EPSS, and has no reported public exploit maturity, so mass exploitation risk appears low; however, kernel privilege-escalation flaws remain important to patch because they can turn limited local access into full system compromise.

How an attack unfolds

An attacker first obtains local access to a Linux system where the batman-adv mesh networking module is present and usable. They then trigger or coordinate batman-adv mesh interface teardown while simultaneously attempting to create new tp_meter sender or receiver sessions. Because vulnerable kernels do not reject those new sessions once the mesh state has left the active state, the attacker can race object cleanup against new session initialization. If the race is won, the kernel may operate on invalid or partially torn-down batman-adv state. Depending on kernel build, memory layout, and available hardening, this may result in a crash, denial of service, or controlled memory corruption that could be used to escalate privileges to kernel/root level.

How to fix it

Update the Linux kernel to a vendor release that includes the batman-adv fix which rejects new tp_meter sessions once mesh_state has left BATADV_MESH_ACTIVE. No universal upstream fixed package version was provided, so use the fixed kernel versions published by the relevant Linux distribution or appliance vendor. If immediate patching is not possible, reduce exposure by unloading or blacklisting the batman-adv module where it is not required, disabling batman-adv mesh networking, restricting local shell access, limiting users with network administration capabilities, and monitoring for attempts to load or manipulate batman-adv. Reboot after applying the kernel update if required by the vendor so the patched kernel is actually running.

How to confirm the fix worked

Confirm the running kernel, not just the installed package, has been updated to a vendor build containing the batman-adv tp_meter teardown fix. Check exposure by determining whether the batman-adv module is loaded or available using tools such as lsmod, modinfo, and distribution package inventory. Validate that mesh interfaces and tp_meter operations are no longer accepted during teardown on a patched test system, or rely on vendor advisory/version confirmation where reproducing kernel races is unsafe. After remediation, verify that systems have rebooted into the patched kernel and that any temporary blacklisting or module-disable controls remain in place where batman-adv is not needed.

Typical attack path

1. Gain local authenticated access to an affected Linux system.
2. Confirm that the batman-adv module is loaded or can be loaded and that batman-adv mesh interfaces can be manipulated.
3. Start batman-adv tp_meter activity while repeatedly tearing down or deactivating the associated mesh interface.
4. Race new tp_meter sender or receiver session creation against mesh teardown after the mesh state has left the active state.
5. Trigger kernel memory corruption, invalid state access, or a kernel crash.
6. If exploitation is reliable, use the corrupted kernel state to escalate privileges or disable the system.

How to detect it

Retrospective detection should focus on kernel logs, audit logs, shell history, endpoint telemetry, and package/module activity. Look for kernel oops, panic, general protection fault, use-after-free, or call traces involving batman-adv or tp_meter, especially near creation or teardown of mesh interfaces. Review auditd, EDR, and command execution logs for unexpected use of batctl, ip link operations involving batadv interfaces, or loading of the batman-adv module with modprobe/insmod. Successful exploitation may leave few durable artifacts beyond privilege escalation effects, so also hunt for local privilege escalation follow-on behavior such as new root shells, unexpected setuid files, unauthorized kernel module activity, altered persistence mechanisms, and suspicious processes shortly after batman-adv-related crashes or configuration changes.

• batman_adv
• batman-adv
• tp_meter
• BATADV_MESH_ACTIVE
• batctl tp
• modprobe batman-adv
• insmod batman-adv
• ip link add name bat0 type batadv
• ip link del bat0
• BUG: kernel NULL pointer dereference
• general protection fault
• kernel BUG
• Oops:
• Call Trace:
• Kernel panic
• batadv_tp_meter
• batadv_tp_meter_start
• batadv_tp_meter_stop

What your security team should do

• Prioritize patching systems that use batman-adv mesh networking, allow local multi-user access, or run workloads where local privilege escalation would materially increase risk.
• Inventory Linux hosts for loaded or available batman-adv support and identify where the module is actually required.
• Apply vendor kernel updates containing the fix and reboot systems into the patched kernel.
• Where batman-adv is unused, blacklist or disable the module to remove the attack surface.
• Restrict local access and network administration privileges on systems that cannot be patched immediately.
• Monitor kernel logs for crashes or oops reports involving batman-adv, tp_meter, or mesh interface teardown.
• Create detections for suspicious use of batctl, modprobe batman-adv, and repeated creation/removal of batman-adv mesh interfaces on systems where this behavior is not expected.
• Because there is no KEV listing, no known ransomware use, low EPSS, and no public exploit maturity reported, treat this as a targeted/local privilege-escalation risk rather than an internet-scale emergency, while still remediating in normal kernel patch cycles.