CVE-2026-52913

What it actually does

This is a Linux kernel denial-of-service flaw in the batman-adv mesh networking subsystem. When a B.A.T.M.A.N. advanced hard interface is disabled, its mesh interface pointer can be cleared while OGMv2 transmission logic still attempts to queue originator messages for that interface. The vulnerable path can dereference a NULL mesh_iface pointer in batadv_v_ogm_queue_on_if(), causing a kernel NULL pointer dereference, kernel oops, and potentially a system crash or reboot depending on kernel configuration.

Why it matters to the business

Systems using the Linux batman-adv mesh networking module may be susceptible to unexpected crashes if the vulnerable interface state transition is triggered. The operational risk is highest for routers, embedded Linux devices, wireless mesh nodes, industrial gateways, and appliances that rely on batman-adv for network availability. Public exploit maturity is currently reported as none, EPSS is very low, and the issue is not listed in CISA KEV, so broad exploitation is not indicated; however, availability-sensitive mesh deployments should still prioritize kernel updates because a crash in a network node can disrupt routing or service continuity.

How an attack unfolds

An attacker would need a way to trigger or race batman-adv OGMv2 processing with a hard-interface disable event. In a typical scenario, the system is running a vulnerable Linux kernel with the batman-adv module loaded and an active mesh interface using OGMv2. The attacker or local operator action causes a batman-adv hard interface to be disabled while OGM transmission work is still pending or being dispatched. Because the disabled hard interface no longer has an associated mesh_iface, the queued OGM path can call netdev_priv() on a NULL pointer. The result is a kernel NULL pointer dereference, usually visible as a kernel oops referencing batadv_v_ogm_queue_on_if() or batadv_v_ogm_send_meshif(), and may lead to loss of service through a crash, reboot, or networking disruption. Exploitation is most plausible by a local privileged user with network administration capability, by management-plane misuse, or by an attacker who has already gained sufficient control over network interface configuration; there is no current evidence of widespread weaponization.

How to fix it

Apply a Linux kernel update that includes the upstream batman-adv fix for this issue. If vendor packages are used, install the fixed kernel supplied by the operating system, appliance, or embedded distribution vendor once available. Because no exact fixed package versions were provided, track vendor advisories for the relevant kernel branch and confirm that the patch ensuring batadv_v_ogm_queue_on_if() validates the expected mesh_iface association is included. Where immediate patching is not possible, mitigate by disabling or unloading the batman-adv module if it is not required, disabling OGMv2/batman-adv mesh functionality where operationally feasible, restricting local network-administration privileges, and limiting access to management interfaces that can bring batman-adv hard interfaces up or down.

How to confirm the fix worked

Confirm exposure by checking whether the running kernel includes batman-adv and whether the module is loaded or built in. Review `lsmod | grep batman`, `/sys/module/batman_adv`, and mesh interface configuration using `ip link`, `batctl`, or distribution-specific network tooling. Confirm remediation by verifying the installed kernel version against the vendor advisory and, where source or changelog access is available, confirming inclusion of the batman-adv fix that prevents OGMv2 queuing on a disabled interface with a NULL or mismatched mesh_iface. After patching and rebooting into the fixed kernel, validate that batman-adv mesh interfaces can be enabled and disabled without kernel oops messages in `dmesg` or system journal logs.

Typical attack path

1. Identify a Linux system that has the batman-adv kernel module loaded and is participating in a B.A.T.M.A.N. advanced mesh network.
2. Confirm that OGMv2 processing is active for a batman-adv mesh interface.
3. Trigger frequent or carefully timed disable/remove events for an associated hard interface while OGM transmission work is pending.
4. Cause batadv_v_ogm_send_meshif() to dispatch work for an interface whose mesh_iface pointer has already been cleared.
5. Trigger a NULL pointer dereference in batadv_v_ogm_queue_on_if().
6. Induce a kernel oops, crash, reboot, or loss of mesh networking service.

How to detect it

To determine whether exploitation or accidental triggering has already occurred, review kernel logs, persistent journal entries, crash dumps, and monitoring alerts for kernel oops or panic events involving the batman-adv module. Relevant log sources include `dmesg`, `/var/log/kern.log`, `/var/log/messages`, `/var/log/syslog`, `journalctl -k`, crash dump directories such as `/var/crash`, and kernel panic collection systems such as kdump or vendor appliance diagnostics. Focus on timestamps near batman-adv interface disable/remove operations, network restarts, mesh reconfiguration, or unexplained reboots. Look for stack traces containing `batadv_v_ogm_queue_on_if`, `batadv_v_ogm_send_meshif`, `netdev_priv`, `batman_adv`, `NULL pointer dereference`, or `kernel BUG/Oops`. Also correlate with audit logs, shell history, orchestration logs, or management-plane events showing repeated `ip link set ... down`, `batctl`, module unload/reload, or network service restart activity. There are no known public attacker-specific payload strings for this issue; detection is therefore crash-artifact and behavior based rather than signature based.

• BUG: kernel NULL pointer dereference
• Oops: 0000
• batadv_v_ogm_queue_on_if
• batadv_v_ogm_send_meshif
• netdev_priv
• batman_adv
• batman-adv
• /sys/module/batman_adv
• /var/crash
• kernel panic - not syncing
• ip link set
• batctl
• unregister_netdevice
• mesh_iface

What your security team should do

• Inventory Linux systems, appliances, routers, embedded devices, and wireless mesh nodes that use the batman-adv kernel module.
• Prioritize patching for availability-critical mesh nodes and devices exposed to untrusted administrators or remote management paths.
• Monitor vendor kernel advisories for fixed builds and update to the first fixed kernel available for each supported distribution or appliance.
• If batman-adv is not required, disable or blacklist the `batman_adv` module to remove exposure.
• Restrict access to commands and APIs that can modify network interfaces, unload modules, or change batman-adv mesh configuration.
• Review kernel logs for recent NULL pointer dereferences or crashes involving `batadv_v_ogm_queue_on_if`, `batadv_v_ogm_send_meshif`, or `batman_adv`.
• For high-availability mesh networks, plan rolling upgrades and failover testing to avoid service interruption during remediation.