CVE-2026-52926

What it actually does

The flaw is an improper cleanup bug in the Linux kernel batman-adv mesh networking subsystem. During mesh teardown, batadv_gw_node_free() removes gateway list entries but previously did not clear the currently selected gateway pointer first. That can leave stale gateway state after cleanup, potentially causing later mesh recreation to fail or behave incorrectly. In practical terms, the impact is denial of service or loss of batman-adv mesh networking functionality on systems that load and use the batman-adv kernel module.

Why it matters to the business

Organizations using Linux-based mesh networking, embedded networking appliances, IoT gateways, routers, or wireless mesh infrastructure with batman-adv may experience service disruption when mesh interfaces are torn down and recreated. The public exploitation likelihood is currently low, with low EPSS, no known KEV listing, and no reported exploit maturity, but affected systems can still suffer operational outages if the vulnerable code path is triggered.

How an attack unfolds

An attacker would need a way to influence or trigger batman-adv mesh interface teardown and recreation, which commonly requires local administrative network privileges or control over management workflows that manipulate mesh interfaces. The attacker causes a batman-adv mesh to have a selected gateway, then triggers teardown of the mesh interface. Because the selected gateway reference is not cleared before gateway list cleanup, stale state can persist. When the mesh is later recreated or gateway logic is exercised again, the stale state can break mesh operation and may lead to loss of connectivity or kernel error conditions. There is no public indication that this vulnerability is being exploited in the wild, and it is most relevant to systems where batman-adv is enabled and actively used.

How to fix it

Update to a Linux kernel build from the relevant distribution or vendor that includes the batman-adv fix clearing bat_priv->gw.curr_gw during teardown before gateway list cleanup. Because no specific affected product or fixed package versions were provided, use the kernel security advisories from the operating system, appliance, or embedded platform vendor to identify the corrected kernel package. If immediate patching is not possible, reduce exposure by disabling batman-adv where it is not required, restricting access to network-management interfaces, limiting CAP_NET_ADMIN privileges, and preventing untrusted users or automation from creating, deleting, or reconfiguring batman-adv mesh interfaces.

How to confirm the fix worked

Confirm that the running kernel package is at or above the vendor-fixed version and that the running kernel, not only the installed package, has been updated. Check whether the batman-adv module is present or loaded using tools such as lsmod, modinfo, and /sys/module/batman_adv. On systems that require batman-adv, validate in a non-production or maintenance window that repeated mesh teardown and recreation completes successfully without kernel warnings, Oops messages, gateway-state errors, or loss of mesh connectivity. For systems that do not require batman-adv, validate that the module is not loaded and cannot be autoloaded by normal users or untrusted services.

Typical attack path

1. Identify a Linux system using the batman-adv kernel module for mesh networking.
2. Obtain local administrative network control, access to a privileged management interface, or another mechanism that can create, delete, or reconfigure batman-adv mesh interfaces.
3. Ensure the mesh has an active or selected gateway state.
4. Trigger mesh teardown by deleting or disabling the batman-adv interface or related mesh configuration.
5. Cause or wait for mesh recreation or gateway handling to occur again.
6. Leverage the stale gateway state to disrupt mesh networking availability or trigger kernel/network instability.

How to detect it

To determine whether this issue may have been triggered, review kernel and system logs around periods of mesh interface deletion, restart, node mobility, gateway changes, or service outages. Useful sources include journald, dmesg, /var/log/kern.log, /var/log/messages, network management logs, systemd unit logs for mesh networking services, container or orchestration audit logs that grant network administration privileges, and appliance management audit logs. Look for batman-adv messages followed by kernel warnings, Oops reports, general protection faults, NULL pointer dereferences, use-after-free reports, interface recreation failures, or unexplained loss of mesh connectivity. Also review command history and audit logs for privileged actions that repeatedly created, deleted, or reconfigured batman-adv interfaces. There are no known attacker-specific payloads or network signatures for this vulnerability; detection should focus on evidence of the vulnerable code path being exercised and resulting instability.

• batman_adv
• batman-adv
• batadv_gw_node_free
• curr_gw
• gw.curr_gw
• gateway list
• Oops:
• kernel BUG
• WARNING: CPU
• general protection fault
• NULL pointer dereference
• use-after-free
• /sys/module/batman_adv
• /sys/class/net/bat0
• /sys/class/net/*/batman_adv/gw_mode
• ip link add name bat0 type batadv
• ip link delete bat0

What your security team should do

• Inventory Linux systems, network appliances, routers, embedded devices, and IoT gateways that load or depend on the batman-adv kernel module.
• Prioritize patching systems where batman-adv is actively used for production mesh networking or where network management actions are exposed to operators, automation, or tenants.
• Apply the vendor-provided fixed kernel package and reboot into the patched kernel where required.
• Disable or blacklist batman-adv on systems that do not need mesh networking functionality.
• Restrict CAP_NET_ADMIN, privileged containers, network namespace management, and administrative interfaces that can manipulate batman-adv interfaces.
• Monitor kernel logs and network availability telemetry for batman-adv teardown, recreation, gateway-selection, or kernel crash events.
• Because this issue is not currently in CISA KEV and has low EPSS, treat it as lower urgency than actively exploited kernel vulnerabilities unless batman-adv is critical to operations.