CVE-2026-46238

What it actually does

This is a use-after-free flaw in the Linux kernel batman-adv mesh networking subsystem, specifically in BAT IV neighbor/originator handling. The vulnerable code can cache a pointer to an originator object that it does not own; after purge processing frees or invalidates that originator entry, later BAT IV logic may dereference the stale pointer. Because this occurs in kernel context and the attack vector is adjacent-network reachable, a malicious Layer 2 neighbor capable of interacting with a batman-adv mesh segment could potentially trigger kernel memory corruption, leading to denial of service and, in worst cases, kernel-level code execution or information disclosure.

Why it matters to the business

Systems using batman-adv mesh networking may be exposed to high-impact compromise from a nearby network attacker without credentials or user interaction. Successful exploitation could crash affected Linux systems, disrupt mesh or edge network availability, or potentially allow an attacker to gain deep control of the operating system. The issue is not currently listed in CISA KEV, has no known public exploit maturity in the provided data, and has a low EPSS score, but the CVSS impact is high because exploitation occurs in kernel space and can affect confidentiality, integrity, and availability.

How an attack unfolds

An attacker first needs adjacent network access to a Layer 2 segment where batman-adv is enabled and participating in mesh routing. They then send crafted or strategically timed batman-adv/BAT IV traffic that influences originator and neighbor state creation, lookup, purge, and reuse. In the vulnerable path, BAT IV stores an auxiliary originator pointer in neighbor state even though that pointer is not owned by the neighbor object. When purge handling removes the referenced originator entry, the cached pointer can become stale. Subsequent BAT IV processing may dereference that freed object, causing kernel memory corruption. Depending on heap layout, timing, kernel hardening, and attacker control over subsequent allocations, the practical result may range from a kernel panic to possible privilege escalation or arbitrary kernel execution. No known exploitation or named threat actor activity was provided, so defenders should treat exploitation as plausible but not confirmed.

How to fix it

Apply a Linux kernel update from the relevant distribution, appliance, or device vendor that includes the batman-adv fix for this issue. No exact fixed version was provided in the input, so remediation should be based on vendor advisories and kernel package changelogs referencing the batman-adv change to stop caching unowned originator pointers in BAT IV. Where immediate patching is not possible, disable or unload the batman-adv module if it is not required, remove unused batman-adv interfaces, and restrict Layer 2 access to mesh segments. For systems that require batman-adv, limit participation to trusted nodes, segment management access, and monitor for kernel instability until patched.

How to confirm the fix worked

Confirm the system is running a vendor kernel build that includes the batman-adv BAT IV originator pointer lifetime fix. Validate exposure by checking whether the batman_adv module is loaded and whether batman-adv interfaces such as bat0 exist. Confirm mitigation by verifying batman_adv is absent or unloaded on systems that do not require it, or that patched kernel packages are installed and the host has been rebooted into the updated kernel. Review kernel package changelogs, distribution security advisories, or source commits for the fix described as stopping cached unowned originator pointers in BAT IV. In lab environments, kernel sanitizers such as KASAN can help confirm that BAT IV originator purge and neighbor handling no longer produces use-after-free reports.

Typical attack path

1. Identify systems or embedded devices participating in a batman-adv mesh network, commonly exposing bat0 or loading the batman_adv kernel module.
2. Gain adjacent Layer 2 access to the same wireless, mesh, bridge, or local network segment as the target batman-adv interface.
3. Generate crafted or timed BAT IV originator/neighbor traffic to manipulate originator lookup and purge behavior.
4. Cause the vulnerable kernel path to cache an originator pointer that can later be freed by purge handling.
5. Trigger later BAT IV processing that dereferences the stale originator pointer.
6. Leverage the resulting use-after-free for denial of service, information disclosure, or possible kernel-level code execution depending on exploit reliability and kernel mitigations.

How to detect it

Retrospective detection is difficult because exploitation would occur inside kernel networking code and may leave only crash, panic, or sanitizer artifacts rather than application logs. Review kernel logs, persistent journal entries, crash dumps, netconsole output, pstore records, and distribution crash reporting for use-after-free, general protection fault, page fault, or panic messages involving batman-adv, batadv, BAT IV, originator, neighbor, or OGM processing. Look for unexpected loading of the batman_adv module, creation of bat0 interfaces, changes to batman-adv mesh participation, and unusual volumes of BATMAN Advanced control traffic from adjacent nodes. If packet captures are available from mesh segments, inspect for anomalous bursts or malformed-looking batman-adv originator messages around the time of crashes. Correlate kernel instability with nearby wireless or Layer 2 mesh activity; repeated crashes triggered by mesh traffic are a strong signal for attempted exploitation or fuzzing.

• batman_adv
• batman-adv
• bat0
• /sys/module/batman_adv
• /sys/class/net/bat0
• modprobe batman-adv
• modprobe batman_adv
• BUG: KASAN: use-after-free
• KASAN: use-after-free
• use-after-free in batadv
• general protection fault
• Unable to handle kernel paging request
• kernel BUG at
• Oops:
• Kernel panic - not syncing
• batadv_iv_ogm
• BAT IV
• originator
• OGM
• purge_orig
• neigh_node

What your security team should do

• Prioritize inventory of Linux systems, network appliances, embedded platforms, wireless mesh nodes, and routers that use batman-adv or expose bat0 interfaces.
• Patch affected systems with vendor-supplied kernel updates and reboot into the fixed kernel as soon as operationally feasible.
• Disable or blacklist the batman_adv kernel module on systems that do not require batman-adv mesh networking.
• Restrict Layer 2 access to batman-adv mesh networks to trusted devices only; treat untrusted adjacent wireless or bridge access as a meaningful attack path.
• Monitor kernel logs for batman-adv errors, KASAN use-after-free reports, unexplained panics, and crashes in batadv/BAT IV code paths.
• Because this is not KEV-listed and has low EPSS in the provided data, balance urgency against exposure: internet-facing risk is generally lower, but exposed mesh and adjacent-network environments should be remediated promptly.