CVE-2026-52931

What it actually does

This flaw affects the Linux kernel B.A.T.M.A.N. advanced (batman-adv) networking subsystem, specifically the tp_meter throughput-metering code. A node acting as a tp_meter receiver can be sent a crafted ACK packet that causes sender-only state to be read before initialization. This results in undefined kernel behavior and may cause memory corruption symptoms such as kernel warnings, crashes, denial of service, or potentially broader kernel instability depending on build options, memory layout, and runtime conditions. Exploitation requires the vulnerable batman-adv functionality to be present and reachable in the relevant mesh-network context.

Why it matters to the business

Systems using vulnerable Linux kernels with batman-adv mesh networking enabled may be exposed to remote disruption from a malicious or compromised mesh participant. The most likely operational consequence is loss of network availability or host instability for devices participating in B.A.T.M.A.N. advanced networks, which can affect wireless mesh, embedded, edge, IoT, lab, or specialized networking deployments. This issue is not currently listed in CISA KEV, is not known to be used in ransomware campaigns, has no public exploit maturity reported, and has a low EPSS score, so urgency is highest for organizations actively using batman-adv rather than all Linux fleets universally.

How an attack unfolds

An attacker first needs network-level access to a B.A.T.M.A.N. advanced mesh or the ability to inject traffic that is processed by the batman-adv kernel module. The attacker identifies a node participating in a tp_meter session as a receiver, then sends a maliciously timed or malformed ACK packet associated with tp_meter handling. Vulnerable kernels incorrectly process the ACK through code paths intended only for sender-role state. Because sender-only fields were not initialized for receiver-role state, the kernel reads invalid data and enters undefined behavior. In practical terms, this can crash the kernel, destabilize networking, or cause denial of service; reliable privilege escalation or code execution is not established from the provided information.

How to fix it

Upgrade to a Linux kernel version that includes the upstream batman-adv fix adding a role check before sender-only tp_meter fields are accessed. Because no exact fixed package versions were provided, use the fixed kernel releases supplied by the relevant Linux distribution, appliance vendor, or kernel source branch. Where immediate patching is not possible, mitigate by disabling the batman-adv module if not required, removing batman-adv interfaces, restricting participation in B.A.T.M.A.N. advanced mesh networks to trusted nodes, and preventing untrusted Layer 2 or mesh-adjacent traffic from reaching vulnerable systems. For embedded or appliance deployments, obtain vendor firmware that incorporates the corrected kernel.

How to confirm the fix worked

Confirm exposure by checking whether the running kernel includes batman-adv support and whether the batman-adv module is loaded or built in. Validate remediation by verifying the installed kernel package or source tree contains the fix that rejects tp_meter ACK/stop processing unless tp_vars->role is BATADV_TP_SENDER. Operationally, confirm that affected systems have rebooted into the patched kernel, not merely installed it. If batman-adv is not required, confirm the module cannot be loaded and no batman-adv mesh interfaces are present. For higher assurance, review distribution advisories or kernel changelogs for the batman-adv tp_meter uninitialized sender-variable fix.

Typical attack path

1. Gain access to the same B.A.T.M.A.N. advanced mesh network or a traffic-injection position where batman-adv frames can reach the target.
2. Identify or induce a tp_meter session involving the target node where the target is acting as a receiver.
3. Send a crafted or malicious ACK packet that is processed by batadv_tp_recv_ack() or related tp_meter stop logic.
4. Trigger vulnerable code paths that assume BATADV_TP_SENDER state and read sender-only variables that were not initialized for a receiver role.
5. Cause undefined kernel behavior, commonly presenting as kernel warnings, networking disruption, system instability, or a denial-of-service crash.

How to detect it

To determine whether exploitation may already have occurred, review kernel and system logs from Linux hosts using batman-adv for unexpected crashes, Oops reports, WARN splats, soft lockups, panics, or sudden reboots correlated with batman-adv or tp_meter activity. Useful sources include journalctl kernel logs, /var/log/kern.log, /var/log/messages, dmesg output, crash dumps, kdump/vmcore artifacts, and network monitoring around mesh interfaces. Look for evidence that the batman-adv module was loaded and active, then correlate instability with receipt of unusual mesh traffic or ACK-like tp_meter behavior from untrusted peers. Network detection is difficult without protocol-aware inspection of B.A.T.M.A.N. advanced traffic; prioritize host telemetry and crash forensics. If kernel crash dumps are available, inspect stack traces for batadv_tp_recv_ack(), batadv_tp_stop(), or tp_meter-related frames.

• batman-adv
• batadv
• tp_meter
• batadv_tp_recv_ack
• batadv_tp_stop
• BATADV_TP_SENDER
• BATADV_TP_RECEIVER
• kernel BUG
• kernel panic
• Oops:
• WARNING: CPU
• general protection fault
• BUG: unable to handle kernel
• soft lockup
• hard lockup
• /sys/module/batman_adv
• /proc/modules
• batman_adv

What your security team should do

• Prioritize patching systems that actively use batman-adv, participate in wireless or Layer 2 mesh networks, or run embedded/edge networking workloads.
• Inventory Linux systems for loaded batman-adv modules and active batman-adv interfaces before treating the issue as fleet-wide critical.
• Apply vendor kernel or firmware updates that include the batman-adv tp_meter role-check fix, then reboot into the fixed kernel.
• Disable or blacklist batman-adv on systems that do not require B.A.T.M.A.N. advanced mesh networking.
• Restrict mesh participation to trusted nodes and monitor for unexpected peers or anomalous tp_meter activity.
• Review kernel logs for crashes, warnings, BUG/Oops traces, or suspicious batman-adv messages around the time of network instability.
• Because this is not KEV-listed, not known ransomware-used, and has low EPSS, align remediation urgency with actual batman-adv exposure rather than Internet-facing service severity.