CVE-2026-63834

What it actually does

This is a denial-of-service flaw in the Linux kernel batman-adv mesh networking component, specifically the throughput meter acknowledgment handling. A remote attacker with the ability to send crafted batman-adv traffic to a vulnerable mesh node can manipulate sequence numbers, gaps, and small message lengths so the receiver creates an unbounded number of entries in the tp_meter unacknowledged-message list. As the list grows, the kernel can consume excessive memory and CPU searching and managing the list, potentially leading to out-of-memory conditions, soft lockups, degraded networking, or system instability.

Why it matters to the business

Systems using batman-adv for mesh networking may experience service disruption, network instability, or host crashes if exposed to malicious mesh traffic. The risk is most relevant to environments that rely on Linux-based mesh networks, embedded devices, routers, wireless infrastructure, industrial deployments, or community/IoT mesh topologies. EPSS is currently low and the vulnerability is not listed in CISA KEV, but denial-of-service issues in kernel networking paths can still create meaningful operational impact where availability is critical.

How an attack unfolds

An attacker first needs network-level access to a vulnerable batman-adv mesh segment or another path that allows crafted batman-adv throughput meter messages to reach the target. The attacker sends a sequence of specially constructed messages using small payload lengths and chosen sequence numbers with gaps. The vulnerable receiver tracks these as unacknowledged entries without a sufficient bound. Over time, the unacked_list grows excessively, causing increasing memory consumption and CPU overhead as the kernel searches and maintains the list. If sustained, this can degrade forwarding performance, stall mesh networking, trigger kernel out-of-memory behavior, or destabilize the host. No public exploit maturity is currently indicated, and there is no KEV or ransomware association provided.

How to fix it

Apply a Linux kernel update from the relevant distribution or vendor that includes the upstream fix for batman-adv tp_meter unacked_list bounding. Because no exact fixed package versions were provided, use vendor advisories and kernel changelogs to confirm inclusion of the patch titled "batman-adv: tp_meter: restrict number of unacked list entries." If immediate patching is not possible, disable or unload the batman-adv module where it is not required, prevent untrusted systems from joining batman-adv mesh networks, restrict Layer 2 adjacency to trusted peers, and monitor or rate-limit suspicious batman-adv traffic where supported by the platform. Reboot may be required after kernel updates to ensure the fixed kernel is running.

How to confirm the fix worked

Confirm that the running kernel, not only the installed kernel package, contains the batman-adv fix. Validate by checking the active kernel version against vendor security advisories, confirming the patched source or changelog includes "batman-adv: tp_meter: restrict number of unacked list entries," and verifying that vulnerable kernels are no longer booted after patching. If batman-adv is not required, confirm the module is not loaded and cannot be autoloaded. Operationally, validate that mesh nodes remain stable under normal throughput meter activity and that memory usage, CPU utilization, and kernel logs do not show abnormal growth, OOM events, or soft lockups associated with batman-adv traffic.

Typical attack path

1. Identify a Linux system participating in a batman-adv mesh network or otherwise reachable via batman-adv traffic.
2. Gain the ability to transmit crafted batman-adv throughput meter messages to the target mesh node.
3. Send messages with small lengths and carefully selected sequence numbers and gaps.
4. Force the vulnerable receiver to allocate a growing number of unacknowledged tp_meter list entries.
5. Sustain traffic until memory pressure, CPU overhead, network degradation, or kernel instability occurs.

How to detect it

Review kernel logs, system journals, network device telemetry, and mesh node monitoring for signs of resource exhaustion correlated with batman-adv activity. Useful sources include dmesg, /var/log/kern.log, /var/log/messages, systemd-journald, OOM killer logs, interface counters, batman-adv diagnostics, and performance telemetry showing kernel CPU spikes or memory pressure. Look for sudden increases in batman-adv throughput meter traffic, repeated OOM events, soft lockups, packet-processing latency, unexplained mesh instability, or hosts rebooting under load. Where forensic tooling is available, inspect loaded modules, kernel stack traces, perf samples, and memory pressure data for batman-adv or batadv-related functions. Because exploitation primarily causes denial of service, indicators may be operational symptoms rather than durable file artifacts.

• batman-adv
• batadv
• tp_meter
• unacked_list
• Out of memory
• oom-killer
• Killed process
• kernel: BUG: soft lockup
• kernel: INFO: rcu_sched detected stalls
• kernel: task blocked for more than
• /sys/module/batman_adv
• /sys/kernel/debug/batman_adv

What your security team should do

• Prioritize remediation for Linux systems that actively use batman-adv, especially routers, wireless mesh nodes, embedded systems, and availability-sensitive network infrastructure.
• Update affected systems to a vendor-supported kernel containing the batman-adv tp_meter unacked_list limit fix, then reboot into the fixed kernel.
• Disable or blacklist the batman-adv module on systems that do not require mesh networking.
• Restrict batman-adv mesh participation to trusted devices and prevent untrusted Layer 2 access to mesh interfaces.
• Add monitoring for kernel OOM events, soft lockups, high CPU in kernel networking paths, and abnormal batman-adv traffic volumes.
• Because EPSS is low and there is no KEV listing, treat this as targeted availability risk rather than broad internet-scale exploitation, but raise urgency where batman-adv is exposed to untrusted peers.