CVE-2026-89951 (GCVE-0-2026-89951)
Vulnerability from cvelistv5
Published
2026-09-16 10:32
Modified
2026-10-19 08:55
Severity ?
8.8 (High) - CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: batman-adv: fix stale receive device on merged fragments Fragment reassembly reuses the skb from the highest-numbered buffered fragment as the merged packet. When that fragment was received on a hard interface which is deleted before the chain completes, the merged skb can re-enter the receive path with a stale skb->dev and skb_iif. batadv_batman_skb_recv() passes such merged packets through the normal receive handlers again. DAT and bridge loop avoidance both derive the ARP header length from skb->dev, so they can dereference the freed net_device before the packet reaches the local mesh interface. Refresh the receive device metadata from the current receive device before running the packet handlers. This keeps internally reinjected merged fragments consistent with the normal receive path after hard interface teardown.
References
Impacted products
Vendor Product Version
Linux Linux Version: 610bfc6bc99bc83680d190ebc69359a05fc7f605
Version: 610bfc6bc99bc83680d190ebc69359a05fc7f605
Version: 610bfc6bc99bc83680d190ebc69359a05fc7f605
Version: 610bfc6bc99bc83680d190ebc69359a05fc7f605
Version: 610bfc6bc99bc83680d190ebc69359a05fc7f605
Version: 610bfc6bc99bc83680d190ebc69359a05fc7f605
Version: 610bfc6bc99bc83680d190ebc69359a05fc7f605
Version: 610bfc6bc99bc83680d190ebc69359a05fc7f605
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/batman-adv/main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "63d86250fa7cbe22451369bd1c0881dfc8190958",
              "status": "affected",
              "version": "610bfc6bc99bc83680d190ebc69359a05fc7f605",
              "versionType": "git"
            },
            {
              "lessThan": "f830c2dfc1431764db9256b3d5db1695fc9a7f56",
              "status": "affected",
              "version": "610bfc6bc99bc83680d190ebc69359a05fc7f605",
              "versionType": "git"
            },
            {
              "lessThan": "f4b4ae763b5d59319fad62a00c76676758e7dafa",
              "status": "affected",
              "version": "610bfc6bc99bc83680d190ebc69359a05fc7f605",
              "versionType": "git"
            },
            {
              "lessThan": "6df64825f8b199921120c685af2abca14b077331",
              "status": "affected",
              "version": "610bfc6bc99bc83680d190ebc69359a05fc7f605",
              "versionType": "git"
            },
            {
              "lessThan": "a2c272da99c2077088083c14961cf2f1e4506995",
              "status": "affected",
              "version": "610bfc6bc99bc83680d190ebc69359a05fc7f605",
              "versionType": "git"
            },
            {
              "lessThan": "e91d2cc7441d89a45bad73ad9789159c7441cb80",
              "status": "affected",
              "version": "610bfc6bc99bc83680d190ebc69359a05fc7f605",
              "versionType": "git"
            },
            {
              "lessThan": "2dffc8c44b6e3347b3719c6419c07b4a18fea895",
              "status": "affected",
              "version": "610bfc6bc99bc83680d190ebc69359a05fc7f605",
              "versionType": "git"
            },
            {
              "lessThan": "ad46c907d7d9975a285c1e89a4adde652eaa93f5",
              "status": "affected",
              "version": "610bfc6bc99bc83680d190ebc69359a05fc7f605",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/batman-adv/main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.13"
            },
            {
              "lessThan": "3.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.270",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.51",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.270",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.221",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.188",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.110",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.51",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.5",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbatman-adv: fix stale receive device on merged fragments\n\nFragment reassembly reuses the skb from the highest-numbered buffered\nfragment as the merged packet. When that fragment was received on a hard\ninterface which is deleted before the chain completes, the merged skb can\nre-enter the receive path with a stale skb-\u003edev and skb_iif.\n\nbatadv_batman_skb_recv() passes such merged packets through the normal\nreceive handlers again. DAT and bridge loop avoidance both derive the ARP\nheader length from skb-\u003edev, so they can dereference the freed net_device\nbefore the packet reaches the local mesh interface.\n\nRefresh the receive device metadata from the current receive device before\nrunning the packet handlers. This keeps internally reinjected merged\nfragments consistent with the normal receive path after hard interface\nteardown."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - Merged BATADV_UNICAST_FRAG packets re-enter batadv_batman_skb_recv() after ETH_P_BATMAN receive on a mesh hard interface; an attacker must inject those frames on the same L2 mesh segment (WiFi IBSS/802.11s, Ethernet backbone, or community-mesh overlay), not via arbitrary Internet routing.\nAC:L - The attacker fully controls fragment headers, inner ARP payload, and both send steps (buffer the highest-numbered fragment, then complete the chain on a remaining active hard interface). In-window fragments are not purged on NETDEV_UNREGISTER, so the stale skb-\u003edev UAF needs no uninfluenceable heap layout.\nPR:N - batadv_batman_skb_recv() is an unauthenticated packet_type handler; any adjacent mesh peer can send BATADV_UNICAST_FRAG frames. Originator presence is obtained by sending OGMs or spoofing a MAC learned from the mesh, with no local account or CAP_NET_ADMIN on the victim.\nUI:N - Exploitation requires only attacker-sent mesh fragments; the kernel buffers, merges, and runs DAT ARP parsing in NET_RX_SOFTIRQ without any victim click, mount, or extra administrative action at exploit time.\nS:U - The use-after-free is of a kernel net_device in batman-adv on the victim host and does not cross a VM/host, IOMMU, or sandbox security authority.\nC:H - After hard-interface unregister, batadv_arp_get_type() calls arp_hdr_len(skb-\u003edev) on the merged skb and reads a freed net_device. A kernel-object UAF is high confidentiality impact because reclaim/spray of that object can disclose heap contents.\nI:H - This is a use-after-free of struct net_device on the fragment-merge receive path. Heap spraying the freed object yields attacker-controlled device fields consumed during packet parsing, a memory-corruption primitive suitable for integrity compromise or control-flow hijacking.\nA:H - Dereferencing a freed net_device from NET_RX_SOFTIRQ can oops, panic, or hang when the object is poisoned or unmapped, denying mesh and host availability even without a full exploit."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-19T08:55:25.323Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/63d86250fa7cbe22451369bd1c0881dfc8190958"
        },
        {
          "url": "https://git.kernel.org/stable/c/f830c2dfc1431764db9256b3d5db1695fc9a7f56"
        },
        {
          "url": "https://git.kernel.org/stable/c/f4b4ae763b5d59319fad62a00c76676758e7dafa"
        },
        {
          "url": "https://git.kernel.org/stable/c/6df64825f8b199921120c685af2abca14b077331"
        },
        {
          "url": "https://git.kernel.org/stable/c/a2c272da99c2077088083c14961cf2f1e4506995"
        },
        {
          "url": "https://git.kernel.org/stable/c/e91d2cc7441d89a45bad73ad9789159c7441cb80"
        },
        {
          "url": "https://git.kernel.org/stable/c/2dffc8c44b6e3347b3719c6419c07b4a18fea895"
        },
        {
          "url": "https://git.kernel.org/stable/c/ad46c907d7d9975a285c1e89a4adde652eaa93f5"
        }
      ],
      "title": "batman-adv: fix stale receive device on merged fragments",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89951",
    "datePublished": "2026-09-16T10:32:36.179Z",
    "dateReserved": "2026-09-11T19:38:34.777Z",
    "dateUpdated": "2026-10-19T08:55:25.323Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.