Kernel Vulnerability in Linux Affecting batman-adv Product

CVE-2026-52931

What is CVE-2026-52931?

An issue was identified in the Linux kernel within the batman-adv networking component, where the functions batadv_tp_recv_ack() and batadv_tp_stop() improperly handle uninitialized sender variables. This vulnerability may allow an attacker to exploit a receiver node in an active tp_meter session by sending a crafted ACK packet, resulting in undefined behavior. To mitigate this, a validation check on the tp_vars role should be implemented before accessing any sender-specific variables.

References