CVE-2026-63835

What it actually does

This is a race condition in the Linux kernel batman-adv mesh networking subsystem. When a batman-adv hard interface is disabled, the OGM aggregation worker and its queued socket buffers are torn down, but another execution path can still enqueue new skbs to the aggregation list through an RCU-visible interface reference. Those newly queued skbs are never processed or freed, causing a kernel memory leak. Repeated triggering can consume kernel memory and lead to degraded networking, process kills, or system-wide denial of service. The flaw is not known to provide code execution or privilege escalation by itself.

Why it matters to the business

Organizations that rely on Linux systems using batman-adv for mesh networking may experience instability or outages if kernel memory is exhausted. The highest practical risk is to routers, embedded devices, wireless mesh nodes, appliances, or operational networks where batman-adv is enabled and interfaces are frequently cycled. This issue is not currently in CISA KEV, is not reported as ransomware-used, has low EPSS, and has no known public exploit maturity, so urgency is mainly driven by whether batman-adv is enabled in production or exposed in critical mesh infrastructure.

How an attack unfolds

An attacker first needs a system where the Linux batman-adv module is loaded and B.A.T.M.A.N. V OGM handling is active. The attacker must then be able to cause or coincide with batman-adv hard-interface disable events while OGM traffic is being queued. In most environments, actively triggering the vulnerable condition requires local administrative capability, control over network interface state, compromised management tooling, or access to a system role that can repeatedly flap mesh interfaces. During the race window, the disable path frees the existing aggregation list and stops the worker, while another CPU can still locate the RCU-protected hard-interface entry and enqueue additional skbs. Those skbs are orphaned and remain allocated. By repeating the sequence, an attacker can steadily leak kernel memory until the system experiences memory pressure, service degradation, OOM kills, or reboot-level instability.

How to fix it

Apply a Linux kernel update that includes the batman-adv fix preventing OGM aggregation from queuing on a disabled hard interface. If using a vendor kernel, install the vendor security update or backport that contains the upstream batman-adv change described as preventing OGM aggregation on disabled hardif. No specific affected or fixed package versions were provided, so remediation should be tracked through the relevant Linux distribution, appliance vendor, or kernel branch advisory. Where immediate patching is not possible, disable or unload the batman-adv module if mesh networking is not required, avoid unnecessary interface flapping on batman-adv mesh nodes, restrict CAP_NET_ADMIN and other administrative paths that can change interface state, and monitor memory pressure on affected systems. A reboot clears already leaked memory but does not fix the underlying vulnerability.

How to confirm the fix worked

Confirm whether the system is exposed by checking if the batman-adv module is present and loaded, whether CONFIG_BATMAN_ADV is enabled, and whether batman-adv mesh interfaces are configured. Validate remediation by confirming the running kernel or vendor build includes the batman-adv patch for blocking OGM queueing after hard-interface disable. On Linux systems, review distribution changelogs, kernel package metadata, and vendor advisories rather than relying only on the upstream version string, because fixes are often backported. For functional validation in a non-production test environment, repeatedly cycle batman-adv hard interfaces under OGM traffic and monitor kernel memory, skb-related slab caches, and dmesg for memory pressure; a fixed kernel should not show unbounded skb/slab growth caused by the interface disable sequence.

Typical attack path

1. Identify a Linux host, router, or appliance with the batman-adv kernel module loaded and mesh networking enabled.
2. Ensure OGM traffic is active on a batman-adv interface using the B.A.T.M.A.N. V routing algorithm.
3. Trigger or wait for hard-interface disable events, such as interface down operations, link flaps, radio resets, or mesh reconfiguration.
4. Race the disable path with OGM queuing so skbs are added after the aggregation worker/list has been shut down.
5. Repeat interface flapping or reconfiguration to accumulate leaked skbs in kernel memory.
6. Cause kernel memory pressure, OOM events, networking disruption, or system instability.

How to detect it

To determine whether this was already exploited or triggered, review kernel logs, system journals, network management logs, and monitoring telemetry from systems with batman-adv enabled. Focus on timelines showing repeated batman-adv interface disable/down events, wireless or Ethernet link flapping, mesh reconfiguration, followed by steady kernel memory consumption, skb/slab cache growth, OOM killer activity, or unexplained reboots. Useful sources include dmesg, /var/log/kern.log, /var/log/messages, journald, interface state-change logs from NetworkManager/systemd-networkd/netifd, appliance management logs, and memory telemetry from node exporters or EDR. Because this vulnerability primarily causes a memory leak, there may be no attacker-specific payload artifact. Detection should correlate suspicious interface cycling or management activity with memory pressure on hosts where the batman_adv module is loaded.

• batman_adv
• batadv
• Out of memory: Killed process
• kernel: page allocation failure
• Memory allocation failure
• skbuff_head_cache
• skb
• oom-killer
• invoked oom-killer
• interface down
• link is down
• NETDEV_DOWN
• bat0

What your security team should do

• Inventory Linux systems, routers, embedded devices, and appliances that use batman-adv mesh networking.
• Prioritize patching systems where batman-adv is enabled on critical, remote, or difficult-to-recover infrastructure.
• If batman-adv is not required, disable the module and prevent it from auto-loading.
• Restrict administrative access and automation capable of bringing batman-adv hard interfaces up or down.
• Monitor affected systems for unexplained kernel memory growth, OOM kills, network instability, and repeated interface flapping.
• Coordinate with network and platform teams before testing, because aggressive interface cycling can disrupt mesh connectivity.
• Track vendor kernel advisories for backported fixes, since no fixed versions were provided in the input.
• Treat evidence of repeated unexplained batman-adv interface resets plus memory exhaustion as suspicious, even though no public exploitation is currently known.