CVE-2026-46233

What it actually does

This Linux kernel flaw is a local denial-of-service vulnerability in the batman-adv mesh networking subsystem, specifically in the bridge loop avoidance claim-purging logic. A race condition can occur when batadv_bla_purge_claims() walks claim entries under RCU while another path releases the same claim through batadv_claim_put() and batadv_claim_release(). During release, the associated backbone_gw pointer may be set to NULL before deferred RCU freeing completes; if the purge path subsequently calls batadv_bla_claim_get_backbone_gw() on that partially released claim, the kernel can hit a NULL pointer dereference and crash. The expected impact is loss of availability through kernel oops, panic, or service disruption on systems where the vulnerable batman-adv code path is reachable.

Why it matters to the business

Successful exploitation can crash affected Linux systems or disrupt networking services that depend on batman-adv, causing downtime for hosts, embedded devices, routers, gateways, or mesh-network nodes. Because exploitation requires local privileges and there is no public exploit maturity or CISA KEV listing, broad internet-scale risk is currently low; however, organizations using batman-adv in production or appliance-like deployments should treat this as an availability risk, especially where untrusted local users, containers, or delegated network administration can interact with mesh networking features.

How an attack unfolds

An attacker first needs local access with enough privilege to exercise batman-adv functionality or influence relevant mesh networking state. They then create or manipulate batman-adv bridge loop avoidance claims while concurrently triggering conditions that release those claims. By racing claim purging against claim release, the attacker attempts to cause the purge path to inspect a claim whose backbone gateway pointer has already been cleared but whose memory has not yet been reclaimed by RCU. If the timing succeeds, the kernel dereferences the NULL pointer in the batman-adv code path, resulting in a kernel oops or panic and denial of service. There is no indication from the provided intelligence that this vulnerability is currently known to be exploited in the wild or used by named threat actors.

How to fix it

Apply a Linux kernel update from the relevant distribution, hardware vendor, or kernel maintenance stream that includes the upstream batman-adv fix described as purging only claims with a valid reference counter. No exact fixed package versions were provided in the input, so remediation should be validated against vendor advisories for each deployed kernel build. Where immediate patching is not possible, reduce exposure by unloading or blacklisting the batman-adv module if it is not required, disabling batman-adv bridge loop avoidance features where operationally feasible, restricting local shell access, limiting CAP_NET_ADMIN and equivalent network-administration privileges, and preventing untrusted containers or users from creating or manipulating batman-adv interfaces. Systems that require batman-adv should be prioritized if they provide routing, mesh networking, gateway, industrial, branch, or embedded connectivity functions.

How to confirm the fix worked

Confirm the running kernel package includes the vendor fix for CVE-2026-46233 or the upstream batman-adv change that avoids purging already released claims. Verify the active kernel after reboot with uname -a and distribution package tooling, and confirm that the installed kernel version matches a vendor-fixed build. Check whether batman-adv is loaded with lsmod, modinfo, or /sys/module/batman_adv, and confirm whether batman-adv interfaces are present with ip link or batctl if available. If batman-adv is not required, validate that it cannot be loaded automatically by confirming blacklist/modprobe policy and reboot persistence. For functional validation in staging, exercise batman-adv claim creation/removal and bridge loop avoidance behavior under load while monitoring dmesg and journal logs for kernel oops, NULL pointer dereference, or batman-adv stack traces.

Typical attack path

1. Obtain local access to an affected Linux system, or access to a context allowed to configure or exercise batman-adv networking.
2. Ensure the batman-adv module/subsystem is loaded and bridge loop avoidance functionality is reachable.
3. Create, update, or remove batman-adv BLA claim state while concurrently causing claim cleanup or release activity.
4. Race batadv_bla_purge_claims() against batadv_claim_put()/batadv_claim_release() so the purge path encounters a partially released claim.
5. Trigger a NULL pointer dereference in batadv_bla_claim_get_backbone_gw().
6. Cause a kernel oops, panic, reboot, or networking outage, resulting in denial of service.

How to detect it

To determine whether exploitation may already have occurred, review kernel logs, system journals, crash dumps, and availability telemetry for kernel oops or panic events involving the batman-adv module. Useful sources include dmesg output, /var/log/kern.log, /var/log/messages, /var/log/syslog, systemd-journald kernel records, kdump/vmcore artifacts, appliance crash reports, and EDR telemetry that captures kernel panics or unexpected reboots. Look for NULL pointer dereference messages, call traces containing batadv_bla_purge_claims(), batadv_bla_claim_get_backbone_gw(), batadv_claim_release(), or batadv_claim_put(), and crashes temporally associated with creation or removal of batman-adv interfaces, bridge loop avoidance activity, or local users/containers with network-administration permissions. Because this is a denial-of-service flaw, exploitation evidence may be limited to crash artifacts and pre-crash kernel traces; absence of file creation, persistence, or network beaconing should not be interpreted as absence of exploitation.

• batadv_bla_purge_claims
• batadv_bla_claim_get_backbone_gw
• batadv_claim_release
• batadv_claim_put
• batman-adv
• batman_adv
• BUG: kernel NULL pointer dereference
• Unable to handle kernel NULL pointer dereference
• Oops: 0000
• Call Trace:
• /sys/module/batman_adv
• /proc/modules: batman_adv
• kernel: batman_adv
• kernel: batman-adv

What your security team should do

• Inventory Linux systems that load or package the batman-adv module, with priority on routers, gateways, embedded devices, mesh-network nodes, and systems granting local users network-administration capabilities.
• Patch affected kernels using vendor-supported updates as soon as practical, and prioritize production systems where availability of mesh networking is business-critical.
• If batman-adv is unused, blacklist or remove the module and verify the control survives reboot and kernel updates.
• Restrict local access and tightly control CAP_NET_ADMIN, privileged containers, network namespaces, and tooling that can create or modify batman-adv interfaces.
• Add monitoring for kernel oops, panic, reboot, and batman-adv stack traces so attempted or successful exploitation is visible to operations and SOC teams.
• Review recent system logs for suspicious crashes or NULL pointer dereferences involving batadv_bla_purge_claims, batadv_bla_claim_get_backbone_gw, or batadv_claim_release.
• Track distribution and appliance-vendor advisories because exact fixed versions vary by kernel branch and downstream backport policy.