Linux Kernel Vulnerability in Batman-adv affecting OGM Transmission

CVE-2026-52913

What is CVE-2026-52913?

A vulnerability in the Linux kernel's batman-adv module was identified where a disabled batadv_hard_iface results in a NULL mesh_iface pointer. Despite the interface being disabled, the function batadv_v_ogm_send_meshif() can still initiate OGM messages through batadv_v_ogm_queue_on_if(). This scenario may cause a system crash due to a NULL pointer dereference when attempting to access the now NULL hard_iface->mesh_iface, indicating a need for additional checks within the code to ensure the integrity of the mesh_iface is maintained before sending OGM messages.

References