CVE-2026-52914

What it actually does

This vulnerability is an integer/length accounting flaw in the Linux kernel batman-adv subsystem used for B.A.T.M.A.N. Advanced mesh networking. During fragment reassembly, batman-adv tracks the accumulated payload length of queued fragments to decide whether a fragment chain is valid before rebuilding the packet. In vulnerable kernels, that accumulated length can be truncated during updates, allowing malformed fragment chains to bypass validation and reach reassembly with inconsistent state. The practical result is a local denial-of-service condition, such as a kernel crash, panic, BUG/Oops, or networking subsystem instability, when crafted batman-adv fragments are processed.

Why it matters to the business

Systems that use batman-adv mesh networking can be made unavailable by a nearby/local attacker or an attacker with the ability to inject crafted batman-adv traffic. The primary consequence is service disruption rather than data theft: affected Linux systems may crash, reboot, lose mesh connectivity, or require manual recovery. The current public risk signal is relatively low because EPSS is low, it is not listed in CISA KEV, it is not marked as used in ransomware, and no mature public exploit is indicated; however, internet or field deployments that rely on batman-adv for operational connectivity should still prioritize patching because a denial of service in kernel networking can cause broad outage impact.

How an attack unfolds

An attacker first needs access to a context where batman-adv traffic can be delivered to a vulnerable Linux kernel, such as membership in the same mesh/broadcast domain, proximity to a wireless mesh segment, compromise of a mesh peer, or local capability to generate raw link-layer traffic. The attacker crafts a malformed sequence of batman-adv fragments whose individual lengths cause the kernel’s accumulated reassembly length accounting to truncate or overflow. Because the vulnerable accounting state is smaller than the true accumulated payload length, the normal fragment-chain validation can be bypassed. The kernel then attempts to reassemble fragments using inconsistent length information, which can trigger a denial-of-service failure in the batman-adv code path. There is no indication from the provided data that this is remotely exploitable over ordinary routed IP traffic, enables privilege escalation, or is currently being exploited by named threat actors.

How to fix it

Apply a Linux kernel update from the operating system or appliance vendor that includes the batman-adv fragment reassembly length-accounting fix published for this issue. No exact fixed package versions were provided in the input, so use vendor advisories for the deployed distribution and kernel stream to identify the corrected kernel build. After installing the updated kernel, reboot systems so the patched kernel and patched batman_adv module are actually running. If batman-adv is not required, reduce exposure by disabling or unloading the batman_adv module, preventing it from autoloading, and removing unused batman-adv interfaces. Where batman-adv is required, restrict mesh membership to trusted peers, limit physical or wireless access to the mesh segment, monitor for malformed BATMAN Advanced traffic, and restrict local raw-packet generation capabilities such as CAP_NET_RAW to trusted administrators and services only.

How to confirm the fix worked

Confirm remediation by verifying that the running kernel package is a vendor-fixed build, not merely that an update is installed on disk. Check the active kernel with uname -r and compare it to the vendor advisory for this issue. Verify whether batman-adv is present or loaded using lsmod, modinfo batman_adv, and /sys/module/batman_adv. Confirm whether active mesh interfaces exist using ip link show and look for batman-adv interfaces such as bat0. If batman-adv is unnecessary, validate that modprobe batman_adv no longer succeeds unintentionally and that no batman-adv interfaces are present after reboot. If source validation is possible, confirm the patched code uses a length-typed accumulated fragment length field and rejects update overflows before reassembly validation. Do not run public or custom crash reproducers on production systems; if validation by reproducer is required, perform it only in an isolated lab with the same kernel build and controlled mesh traffic.

Typical attack path

1. Identify a Linux target that has the batman-adv kernel module loaded or an active batman-adv mesh interface, commonly named bat0.
2. Gain the ability to send batman-adv frames to the target, such as by joining the same mesh network, controlling a mesh peer, or using local raw packet injection capability.
3. Generate malformed batman-adv fragment chains with accumulated payload lengths that trigger truncation in vulnerable reassembly accounting.
4. Deliver the crafted fragments to the target over the mesh/link-layer path.
5. Cause batman-adv fragment validation to accept an inconsistent fragment chain and proceed into unsafe reassembly state.
6. Trigger kernel instability, crash, panic, or loss of networking availability, resulting in denial of service.

How to detect it

To determine whether this was already exploited, focus on kernel, system, crash, and network telemetry from systems that load batman-adv. Review journald, syslog, dmesg, kmsg, pstore, netconsole, kernel crash dumps, and hypervisor or hardware watchdog reset logs for crashes or warnings involving batman_adv, batman-adv, fragmentation, fragment reassembly, Oops, BUG, panic, soft lockup, general protection fault, or unexpected reboot events. Correlate these events with the presence of active batman-adv interfaces and with spikes in BATMAN Advanced link-layer traffic. If packet capture is available, inspect traffic using EtherType 0x4305 and look for abnormal volumes or malformed sequences of batman-adv fragmented packets before the crash. Because exploitation is expected to produce denial-of-service symptoms rather than durable host artifacts, absence of files or persistence mechanisms does not rule it out. Prioritize investigation where multiple mesh nodes crash around the same time, a single peer precedes instability, or logs repeatedly reference batman_adv fragmentation paths.

• batman_adv
• batman-adv
• /sys/module/batman_adv
• bat0
• net/batman-adv/fragmentation.c
• BATMAN Advanced
• EtherType 0x4305
• ethertype 0x4305
• kernel BUG
• Oops:
• Kernel panic
• soft lockup
• general protection fault
• watchdog: BUG: soft lockup
• batadv_frag
• batadv_frag_reassemble
• batadv_frag_merge
• batadv_frag_insert

What your security team should do

• Inventory Linux systems and appliances for loaded batman-adv support using lsmod, modinfo batman_adv, /sys/module/batman_adv, and interface checks for batman-adv devices such as bat0.
• Prioritize kernel updates for systems where batman-adv is actively used for wireless, mesh, lab, IoT, embedded, industrial, or field connectivity, because exploitation can directly disrupt availability.
• If batman-adv is not required, disable the module and block autoloading as a compensating control until patching is complete.
• For required deployments, restrict mesh participation to trusted nodes and monitor the mesh segment for malformed or unusual BATMAN Advanced fragmentation traffic.
• Review local privilege boundaries and remove unnecessary CAP_NET_RAW or raw socket access from users, containers, and services that do not need packet injection capability.
• After patching, reboot and verify the running kernel version; do not rely only on package installation status.
• Add detections for kernel crashes, Oops messages, panics, or soft lockups that reference batman_adv or batman-adv fragmentation paths.
• Treat repeated batman-adv-related kernel faults or unexplained mesh-node reboots as potential exploitation attempts and preserve kernel logs, crash dumps, and packet captures where available.