CVE-2026-52916

What it actually does

This is a Linux kernel denial-of-service flaw in the B.A.T.M.A.N. Advanced (batman-adv) mesh networking subsystem. A malicious peer can send a BATADV_UNICAST_FRAG packet whose reassembled payload is another fragmented unicast packet. Because the receiver recursively re-enters the packet processing path after defragmentation, nested fragments can grow kernel stack usage until the stack is exhausted, potentially causing a kernel crash, panic, or device reboot. The issue is specific to systems with batman-adv enabled or loaded and exposed to untrusted mesh/L2 traffic.

Why it matters to the business

Exploitation can take affected Linux systems offline, disrupting mesh networking, embedded gateways, routers, access points, IoT fleets, industrial edge devices, or any Linux hosts using batman-adv. The current public exploitation signal is low: EPSS is 0.00123, it is not listed in CISA KEV, no ransomware association is reported, and no mature public exploit is indicated. However, because kernel crashes can cause immediate service outages and because batman-adv is commonly used in specialized network and embedded deployments, exposed systems should still be patched or mitigated during normal maintenance, with higher urgency for devices reachable by untrusted mesh participants.

How an attack unfolds

An attacker first needs the ability to inject B.A.T.M.A.N. Advanced frames into a network segment or mesh where the target processes batman-adv traffic. The attacker crafts a unicast-fragment packet that appears valid enough to be accepted and buffered for reassembly. After all fragments are collected, the kernel reassembles the payload and passes it back into the batman-adv receive path. Instead of being a normal inner payload, the attacker makes the reassembled packet another BATADV_UNICAST_FRAG packet. This causes the same receive and defragmentation logic to recurse repeatedly. With enough nesting, kernel stack space is exhausted, leading to a crash or panic and denial of service. The fix rejects packets that are still unicast-fragment packets after defragmentation, preventing the recursive processing condition.

How to fix it

Upgrade to a Linux kernel version or vendor distribution kernel that includes the batman-adv fix which discards reassembled payloads that are still BATADV_UNICAST_FRAG packets. No exact fixed package versions were provided in the input, so use the relevant Linux distribution, appliance vendor, or kernel stable release advisory as the source of truth. Where immediate patching is not possible, disable or unload the batman-adv module if it is not required, prevent automatic loading of the module, restrict participation in the mesh to trusted peers, and block or isolate untrusted L2 access to interfaces carrying batman-adv traffic. For embedded or appliance deployments, obtain firmware updates from the vendor because the vulnerable code may be delivered as part of the device kernel image.

How to confirm the fix worked

Confirm exposure by checking whether batman-adv is present and active, for example by reviewing loaded modules, kernel configuration, mesh interfaces, and service or network configuration that references batman-adv. Confirm remediation by verifying the running kernel package or firmware version matches a vendor release that includes the fix, not merely that an updated package is installed on disk. Reboot if required so the patched kernel is active. Validate that batman-adv traffic is only accepted from intended mesh interfaces and trusted peers. If using a lab environment, controlled negative testing should show that nested BATADV_UNICAST_FRAG payloads are dropped rather than recursively processed; do not run crash-triggering tests on production systems.

Typical attack path

1. Identify Linux systems participating in or reachable through a B.A.T.M.A.N. Advanced mesh network.
2. Confirm that the target processes batman-adv traffic on an accessible interface.
3. Send specially crafted BATADV_UNICAST_FRAG traffic containing nested unicast-fragment payloads.
4. Trigger recursive processing during packet reassembly in the kernel receive path.
5. Exhaust kernel stack space and cause a crash, panic, reboot, or loss of network service.

How to detect it

Look for evidence of unexpected kernel crashes, panics, watchdog resets, or reboots on systems running batman-adv, especially following bursts of mesh traffic. Review kernel logs, system journals, crash dumps, netconsole output, serial console logs, appliance event logs, and monitoring alerts for stack exhaustion or call traces involving batman-adv fragmentation and receive functions. Network telemetry is harder because this is L2 mesh traffic, but packet captures from affected interfaces may show B.A.T.M.A.N. Advanced frames, especially repeated or malformed unicast-fragment traffic. If crash dumps are available, inspect backtraces for repeated recursion through batadv_batman_skb_recv(), batadv_recv_frag_packet(), and batadv_frag_skb_buffer(). Correlate suspected events with interface counters, mesh peer changes, unusual traffic volume, or frames from unknown MAC addresses on batman-adv segments. There are no named threat actors or known ransomware campaigns associated with this issue in the provided data.

• batman-adv
• BATADV_UNICAST_FRAG
• batadv_batman_skb_recv
• batadv_recv_frag_packet
• batadv_frag_skb_buffer
• kernel stack overflow
• Kernel panic - not syncing
• BUG: kernel stack guard page was hit
• stack segment: 0000
• ethertype 0x4305

What your security team should do

• Inventory Linux systems, appliances, routers, wireless mesh nodes, and embedded devices that use or load batman-adv.
• Prioritize patching systems where batman-adv interfaces are reachable by untrusted or semi-trusted mesh participants.
• Apply vendor kernel or firmware updates that include the batman-adv fragment handling fix, then reboot into the patched kernel where required.
• Disable, blacklist, or remove batman-adv on systems that do not require B.A.T.M.A.N. Advanced mesh networking.
• Segment mesh networks and restrict L2 adjacency so only trusted devices can send batman-adv frames to vulnerable nodes.
• Monitor kernel logs and crash telemetry for stack exhaustion, kernel panic, or call traces involving batman-adv receive and fragmentation functions.
• Because this is not currently KEV-listed and has low EPSS, handle broad enterprise patching through normal vulnerability management, but treat exposed mesh infrastructure as higher priority due to outage risk.