Local Denial of Service Vulnerability in Linux Kernel batman-adv

CVE-2026-52914

What is CVE-2026-52914?

The batman-adv component of the Linux kernel contains a vulnerability that can be exploited to bypass fragment validation checks, leading to potential denial of service conditions. This occurs when malformed fragment chains are processed without proper validation due to a flaw in payload length accounting. The vulnerability allows the accumulated length of queued fragments to be truncated during updates, which can enable an attacker to provoke inconsistent states during the reassembly process. Recent updates to the batman-adv have addressed this issue by employing a new length-typed field for storage and implementing overflow protections to ensure reassembly only occurs with valid fragment lengths.

References