Linux Kernel Vulnerability in Batman-adv Affecting Traffic Management

CVE-2026-63835

What is CVE-2026-63835?

A vulnerability in the batman-adv module of the Linux kernel allows for the potential accumulation of sk_buff (skb) instances in the aggregation list when network interfaces are disabled. Specifically, even after an interface is marked as inactive, the system can still queue new skbs to an aggregation list through the batadv_v_ogm_queue_on_if() function. This leads to an unbounded increase in memory usage since these skbs remain unprocessed and unreleased, ultimately resulting in a memory leak. To mitigate this, the batadv_v_ogm_iface_disable() function needs to properly block any further queuing of skbs during the interface disablement process, ensuring memory integrity and optimal resource management.

References