Unicast Fragment Vulnerability in Linux Kernel by Linux Foundation

CVE-2026-52916

What is CVE-2026-52916?

A vulnerability in the Linux kernel's batman-adv component allows for a specially crafted BATADV_UNICAST_FRAG packet to cause recursive processing. This can lead to unbounded growth of the kernel stack when fragments are reassembled, effectively exhausting system resources. The vulnerability occurs when a malicious sender crafts a packet with nested BATADV_UNICAST_FRAG packets, leading to a denial of service. Proper handling mechanisms for fragment processing have been implemented to discard invalid packets and mitigate the exploitation risks.

References