Linux kernel Vulnerability in batman-adv: Issue with Neighbor State Caching

CVE-2026-46238

What is CVE-2026-46238?

A vulnerability exists in the batman-adv module of the Linux kernel, which improperly caches unowned originator pointers in the BAT IV neighbor state. The affected implementation could lead to scenarios where the neighbor node retains a reference to an originator pointer derived from a temporary lookup that may no longer point to a valid originator after purge handling operations. To remedy this, the implementation has been updated to prevent the storage of auxiliary originator pointers, requiring the module to resolve neighbor originator data from the stored neighbor address directly, thereby ensuring safer resource handling.

References