CVE-2026-52919

What it actually does

This is a Linux kernel use-after-free in the batman-adv mesh networking subsystem's throughput meter sender shutdown path. The vulnerable code can decrement an atomic "sending" counter more than once when shutdown is reached through multiple paths such as timeout, user cancellation, or normal completion. If the counter underflows to a negative value, sender logic treats it as non-zero and continues running a kernel thread after related interface resources have been freed. The result is a lingering kernel thread that may access freed memory when the batman-adv interface is removed, causing kernel memory corruption, crashes, or potentially privilege-impacting behavior depending on kernel configuration and exploitability.

Why it matters to the business

Organizations using Linux systems with batman-adv enabled may experience host instability, kernel crashes, or service outages if the vulnerable throughput-meter path is triggered. Because this affects kernel code, impact can extend beyond the mesh networking function to the whole host. The currently provided intelligence indicates low EPSS, no CISA KEV listing, no ransomware association, and no public exploit maturity, so broad opportunistic exploitation appears unlikely at this time; however, systems that actively use batman-adv or allow privileged users/containers to manipulate network interfaces should treat this as an operational reliability and kernel-hardening issue.

How an attack unfolds

An attacker first needs access to a system where the batman-adv kernel module is available and the attacker can interact with batman-adv networking controls, typically requiring elevated local privileges such as CAP_NET_ADMIN or equivalent administrative control. The attacker starts or triggers a batman-adv throughput meter sender operation, then causes multiple shutdown paths to race or execute against the same sender state, for example by combining cancellation, timeout, normal completion, or interface teardown activity. In the vulnerable kernel, the shutdown function decrements the sender counter unconditionally, allowing it to underflow below zero. Because the sender thread interprets any non-zero counter value as still active, it can continue running indefinitely. If the corresponding batman-adv interface is then removed, the thread may continue referencing already-freed interface or sender state, resulting in a use-after-free condition. Practically, exploitation is most likely to manifest as a kernel warning, kernel panic, hung kthread, or denial of service, with deeper exploitation depending on memory layout, hardening features, and attacker capability.

How to fix it

Update the Linux kernel to a vendor-supported version that includes the batman-adv fix using atomic_xchg() so the sender counter transitions from 1 to 0 only once. Where package-specific fixed versions are not available, use the latest security kernel from the operating system vendor or distribution channel and confirm that the patch for net/batman-adv/tp_meter.c is included. Reboot into the patched kernel after installation. If batman-adv is not required, disable or unload the module and prevent future loading using distribution-appropriate module denylisting. Restrict CAP_NET_ADMIN and network namespace privileges for users, services, and containers, because these capabilities can expose kernel networking attack surface. Avoid granting privileged container mode or broad network-administration capabilities unless operationally necessary.

How to confirm the fix worked

Confirm exposure by checking whether the running kernel includes batman-adv support and whether the module is loaded, for example with lsmod, modinfo, distribution package metadata, and kernel advisory tooling. Confirm remediation by verifying the running kernel version after reboot matches a vendor release containing the fix, not merely that an updated package is installed on disk. If source or build metadata is available, verify the batman-adv throughput meter shutdown logic uses an atomic exchange or equivalent one-time transition instead of unconditional decrement. Validate that batman-adv is not loaded on systems where it is not needed. Review whether untrusted users, services, or containers have CAP_NET_ADMIN, privileged container mode, or permissions to create/remove network interfaces. In non-production testing only, exercise batman-adv throughput-meter start/cancel/interface-removal workflows and confirm there are no kernel warnings, hung batadv sender threads, KASAN reports, or panics.

Typical attack path

1. Identify a Linux host where the batman-adv module is loaded or can be loaded.
2. Obtain sufficient local privileges to manage network interfaces or batman-adv controls, such as CAP_NET_ADMIN.
3. Create or use a batman-adv interface and trigger the throughput meter sender functionality.
4. Force overlapping shutdown conditions such as timeout, cancellation, completion, or interface removal.
5. Cause the sender atomic counter to be decremented more than once and underflow to a negative value.
6. Allow the zombie sender kernel thread to continue running while the interface or related resources are freed.
7. Trigger kernel instability, crash, or potential memory-corruption side effects from the use-after-free.

How to detect it

Look for signs of prior exploitation or triggering in kernel and system logs rather than relying on network indicators. Relevant sources include journald, dmesg, /var/log/kern.log, /var/log/messages, auditd, EDR telemetry, container runtime logs, and shell/process history where available. Hunt for batman-adv module loading, batctl throughput-meter activity, interface creation or deletion around the same time as kernel warnings, stuck kernel threads, high CPU use by kernel threads, KASAN use-after-free reports, kernel oopses, panics, or messages about unregistering network devices. Audit for use of CAP_NET_ADMIN, privileged containers, network namespace manipulation, modprobe of batman-adv, and rapid creation/removal of batadv interfaces. There are no known public exploit-specific payload strings from the supplied intelligence; detections should focus on vulnerable feature use combined with kernel memory-safety symptoms.

• batman-adv
• batman_adv
• batadv
• tp_meter
• batadv_tp_sender_shutdown
• batadv_tp_send
• BUG: KASAN: use-after-free
• use-after-free
• kernel BUG
• kernel panic
• Oops:
• unregister_netdevice: waiting for
• hung task
• blocked for more than
• modprobe batman-adv
• modprobe batman_adv
• batctl tp
• ip link add name bat
• ip link del bat
• CAP_NET_ADMIN

What your security team should do

• Inventory Linux systems where batman-adv is loaded, available, or required for mesh networking.
• Prioritize patching systems that actively use batman-adv, allow local administrative users, run privileged containers, or grant CAP_NET_ADMIN to workloads.
• Update to a vendor kernel containing the batman-adv tp_meter counter-underflow fix and reboot to activate it.
• Disable or denylist the batman-adv module on systems that do not require B.A.T.M.A.N. Advanced mesh networking.
• Reduce kernel attack surface by removing unnecessary CAP_NET_ADMIN permissions and avoiding privileged containers where possible.
• Monitor kernel logs for use-after-free, KASAN, hung kthread, batman-adv, and network-interface teardown anomalies.
• Because this is not currently KEV-listed and has low EPSS, handle broad fleet remediation through normal kernel security maintenance, but escalate priority for exposed batman-adv deployments.