Cloudanix VulnDB

CVE-2026-93204

None

CVSS

—

EPSS

0.2%

Published

Sep 17, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A timing flaw in a Linux mesh-networking component could let attackers cause devices to use or send broken hardware addresses, leading to lost or misdirected network traffic.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Moderate
Impact
Data Tampering
Component
OS kernel
Class
Race Condition
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Non-atomic copy of a 48-bit MAC address in batadv_dat_entry_add() allows concurrent readers to observe a torn value, resulting in either a corrupted MAC being forwarded over the mesh or an ARP response containing the partial address that poisons remote caches.

Why it matters to the business

Mesh nodes using batman-adv may silently forward or respond with invalid MAC addresses, causing intermittent connectivity loss, traffic misdirection, or ARP cache corruption that is difficult to diagnose in production networks.

How an attack unfolds

An attacker with the ability to trigger concurrent updates and reads on the DAT table (for example by sending crafted packets that race with MAC address changes) can induce a reader to emit a torn MAC address, which is then placed on the wire or used in an ARP reply, poisoning downstream ARP tables and enabling traffic interception or denial of service.

How to fix it

Upgrade the Linux kernel to a version that applies the atomic64_t change for batadv_dat_entry_add() and rebuild any out-of-tree batman-adv modules; no configuration changes are required.

How to confirm the fix worked

Confirm the kernel source contains the atomic64_t stores and loads for the MAC address field in batadv_dat_entry_add(); run targeted concurrency tests that update and read DAT entries while monitoring for torn MAC values on the wire.

Typical attack path

  1. Establish presence on the same batman-adv mesh or adjacent layer-2 segment
  2. Trigger batadv_dat_entry_add() while a parallel reader path executes
  3. Cause the reader to forward the torn MAC address or generate a poisoned ARP response
  4. Observe or leverage the resulting ARP cache corruption or misrouted traffic

How to detect it

Inspect kernel logs for batman-adv DAT-related warnings, capture mesh traffic for MAC addresses that change mid-packet or contain impossible values, and review ARP tables on mesh participants for entries that do not match any legitimate station.

What your security team should do

  • Prioritize kernel upgrades on any system running batman-adv with DAT enabled
  • Monitor upstream stable kernel releases for the backported atomic64_t fix
  • Add batman-adv mesh nodes to the normal kernel update testing cycle

The record

In the Linux kernel, the following vulnerability has been resolved: batman-adv: dat: atomically update mac addresses When a MAC address is updated in batadv_dat_entry_add(), it is done using a simple copy function. A parallel reader might only see parts of this update. In worst case, the reader is transporting the half updated MAC address over the network or is creating an ARP response using it - poisoning the ARP cache. atomic64_t can be used to store the 48 bit of a mac address. A reader will then either see the old mac address or the new one - never a mixture of both.

Affected packages

Ecosystem Package Introduced Fixed