Use-After-Free Vulnerability in Linux Kernel Affects Batman-adv Component

CVE-2026-46212

What is CVE-2026-46212?

A use-after-free vulnerability has been identified in the batman-adv component of the Linux kernel. When the function batadv_bla_del_backbone_claims() is executed to remove all claims from a backbone, a link entry within a hash list is dropped. This action was found to be flawed as the reference for the link entry remains active until batadv_claim_put() is appropriately called after ensuring no further access to the claim object takes place. If batadv_claim_put() is invoked prematurely, there is a risk that the claim may be deallocated by batadv_claim_release() before the link entry is safely removed, leading to potential exploitation.

References