CVE-2026-89951 (GCVE-0-2026-89951)

Vulnerability from cvelistv5 – Published: 2026-09-16 10:32 – Updated: 2026-09-16 14:40
VLAI
Title
batman-adv: fix stale receive device on merged fragments
Summary
In the Linux kernel, the following vulnerability has been resolved: batman-adv: fix stale receive device on merged fragments Fragment reassembly reuses the skb from the highest-numbered buffered fragment as the merged packet. When that fragment was received on a hard interface which is deleted before the chain completes, the merged skb can re-enter the receive path with a stale skb->dev and skb_iif. batadv_batman_skb_recv() passes such merged packets through the normal receive handlers again. DAT and bridge loop avoidance both derive the ARP header length from skb->dev, so they can dereference the freed net_device before the packet reaches the local mesh interface. Refresh the receive device metadata from the current receive device before running the packet handlers. This keeps internally reinjected merged fragments consistent with the normal receive path after hard interface teardown.
Severity
8.8 (High)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 610bfc6bc99bc83680d190ebc69359a05fc7f605 , < 63d86250fa7cbe22451369bd1c0881dfc8190958 (git)
Affected: 610bfc6bc99bc83680d190ebc69359a05fc7f605 , < f830c2dfc1431764db9256b3d5db1695fc9a7f56 (git)
Affected: 610bfc6bc99bc83680d190ebc69359a05fc7f605 , < f4b4ae763b5d59319fad62a00c76676758e7dafa (git)
Affected: 610bfc6bc99bc83680d190ebc69359a05fc7f605 , < 6df64825f8b199921120c685af2abca14b077331 (git)
Affected: 610bfc6bc99bc83680d190ebc69359a05fc7f605 , < a2c272da99c2077088083c14961cf2f1e4506995 (git)
Affected: 610bfc6bc99bc83680d190ebc69359a05fc7f605 , < e91d2cc7441d89a45bad73ad9789159c7441cb80 (git)
Affected: 610bfc6bc99bc83680d190ebc69359a05fc7f605 , < 2dffc8c44b6e3347b3719c6419c07b4a18fea895 (git)
Affected: 610bfc6bc99bc83680d190ebc69359a05fc7f605 , < ad46c907d7d9975a285c1e89a4adde652eaa93f5 (git)
guessed Create a notification for this product.
Linux Linux Affected: 3.13
Unaffected: 0 , < 3.13 (semver)
Unaffected: 5.10.270 , ≤ 5.10.* (semver)
Unaffected: 5.15.221 , ≤ 5.15.* (semver)
Unaffected: 6.1.188 , ≤ 6.1.* (semver)
Unaffected: 6.6.157 , ≤ 6.6.* (semver)
Unaffected: 6.12.110 , ≤ 6.12.* (semver)
Unaffected: 6.18.51 , ≤ 6.18.* (semver)
Unaffected: 7.2.5 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/batman-adv/main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "63d86250fa7cbe22451369bd1c0881dfc8190958",
              "status": "affected",
              "version": "610bfc6bc99bc83680d190ebc69359a05fc7f605",
              "versionType": "git"
            },
            {
              "lessThan": "f830c2dfc1431764db9256b3d5db1695fc9a7f56",
              "status": "affected",
              "version": "610bfc6bc99bc83680d190ebc69359a05fc7f605",
              "versionType": "git"
            },
            {
              "lessThan": "f4b4ae763b5d59319fad62a00c76676758e7dafa",
              "status": "affected",
              "version": "610bfc6bc99bc83680d190ebc69359a05fc7f605",
              "versionType": "git"
            },
            {
              "lessThan": "6df64825f8b199921120c685af2abca14b077331",
              "status": "affected",
              "version": "610bfc6bc99bc83680d190ebc69359a05fc7f605",
              "versionType": "git"
            },
            {
              "lessThan": "a2c272da99c2077088083c14961cf2f1e4506995",
              "status": "affected",
              "version": "610bfc6bc99bc83680d190ebc69359a05fc7f605",
              "versionType": "git"
            },
            {
              "lessThan": "e91d2cc7441d89a45bad73ad9789159c7441cb80",
              "status": "affected",
              "version": "610bfc6bc99bc83680d190ebc69359a05fc7f605",
              "versionType": "git"
            },
            {
              "lessThan": "2dffc8c44b6e3347b3719c6419c07b4a18fea895",
              "status": "affected",
              "version": "610bfc6bc99bc83680d190ebc69359a05fc7f605",
              "versionType": "git"
            },
            {
              "lessThan": "ad46c907d7d9975a285c1e89a4adde652eaa93f5",
              "status": "affected",
              "version": "610bfc6bc99bc83680d190ebc69359a05fc7f605",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/batman-adv/main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.13"
            },
            {
              "lessThan": "3.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.270",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.51",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.270",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.221",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.188",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.110",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.51",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.5",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbatman-adv: fix stale receive device on merged fragments\n\nFragment reassembly reuses the skb from the highest-numbered buffered\nfragment as the merged packet. When that fragment was received on a hard\ninterface which is deleted before the chain completes, the merged skb can\nre-enter the receive path with a stale skb-\u003edev and skb_iif.\n\nbatadv_batman_skb_recv() passes such merged packets through the normal\nreceive handlers again. DAT and bridge loop avoidance both derive the ARP\nheader length from skb-\u003edev, so they can dereference the freed net_device\nbefore the packet reaches the local mesh interface.\n\nRefresh the receive device metadata from the current receive device before\nrunning the packet handlers. This keeps internally reinjected merged\nfragments consistent with the normal receive path after hard interface\nteardown."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - Merged BATADV_UNICAST_FRAG packets re-enter batadv_batman_skb_recv() after ETH_P_BATMAN receive on a mesh hard interface; an attacker must inject those frames on the same L2 mesh segment (WiFi IBSS/802.11s, Ethernet backbone, or community-mesh overlay), not via arbitrary Internet routing.\nAC:L - The attacker fully controls fragment headers, inner ARP payload, and both send steps (buffer the highest-numbered fragment, then complete the chain on a remaining active hard interface). In-window fragments are not purged on NETDEV_UNREGISTER, so the stale skb-\u003edev UAF needs no uninfluenceable heap layout.\nPR:N - batadv_batman_skb_recv() is an unauthenticated packet_type handler; any adjacent mesh peer can send BATADV_UNICAST_FRAG frames. Originator presence is obtained by sending OGMs or spoofing a MAC learned from the mesh, with no local account or CAP_NET_ADMIN on the victim.\nUI:N - Exploitation requires only attacker-sent mesh fragments; the kernel buffers, merges, and runs DAT ARP parsing in NET_RX_SOFTIRQ without any victim click, mount, or extra administrative action at exploit time.\nS:U - The use-after-free is of a kernel net_device in batman-adv on the victim host and does not cross a VM/host, IOMMU, or sandbox security authority.\nC:H - After hard-interface unregister, batadv_arp_get_type() calls arp_hdr_len(skb-\u003edev) on the merged skb and reads a freed net_device. A kernel-object UAF is high confidentiality impact because reclaim/spray of that object can disclose heap contents.\nI:H - This is a use-after-free of struct net_device on the fragment-merge receive path. Heap spraying the freed object yields attacker-controlled device fields consumed during packet parsing, a memory-corruption primitive suitable for integrity compromise or control-flow hijacking.\nA:H - Dereferencing a freed net_device from NET_RX_SOFTIRQ can oops, panic, or hang when the object is poisoned or unmapped, denying mesh and host availability even without a full exploit."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-16T14:40:34.244Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/63d86250fa7cbe22451369bd1c0881dfc8190958"
        },
        {
          "url": "https://git.kernel.org/stable/c/f830c2dfc1431764db9256b3d5db1695fc9a7f56"
        },
        {
          "url": "https://git.kernel.org/stable/c/f4b4ae763b5d59319fad62a00c76676758e7dafa"
        },
        {
          "url": "https://git.kernel.org/stable/c/6df64825f8b199921120c685af2abca14b077331"
        },
        {
          "url": "https://git.kernel.org/stable/c/a2c272da99c2077088083c14961cf2f1e4506995"
        },
        {
          "url": "https://git.kernel.org/stable/c/e91d2cc7441d89a45bad73ad9789159c7441cb80"
        },
        {
          "url": "https://git.kernel.org/stable/c/2dffc8c44b6e3347b3719c6419c07b4a18fea895"
        },
        {
          "url": "https://git.kernel.org/stable/c/ad46c907d7d9975a285c1e89a4adde652eaa93f5"
        }
      ],
      "title": "batman-adv: fix stale receive device on merged fragments",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89951",
    "datePublished": "2026-09-16T10:32:36.179Z",
    "dateReserved": "2026-09-11T19:38:34.777Z",
    "dateUpdated": "2026-09-16T14:40:34.244Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-89951",
      "date": "2026-09-25",
      "epss": "0.00412",
      "percentile": "0.32766"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "net/batman-adv/main.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "63d86250fa7cbe22451369bd1c0881dfc8190958",
                    "status": "affected",
                    "version": "610bfc6bc99bc83680d190ebc69359a05fc7f605",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "f830c2dfc1431764db9256b3d5db1695fc9a7f56",
                    "status": "affected",
                    "version": "610bfc6bc99bc83680d190ebc69359a05fc7f605",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "f4b4ae763b5d59319fad62a00c76676758e7dafa",
                    "status": "affected",
                    "version": "610bfc6bc99bc83680d190ebc69359a05fc7f605",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6df64825f8b199921120c685af2abca14b077331",
                    "status": "affected",
                    "version": "610bfc6bc99bc83680d190ebc69359a05fc7f605",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "a2c272da99c2077088083c14961cf2f1e4506995",
                    "status": "affected",
                    "version": "610bfc6bc99bc83680d190ebc69359a05fc7f605",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "e91d2cc7441d89a45bad73ad9789159c7441cb80",
                    "status": "affected",
                    "version": "610bfc6bc99bc83680d190ebc69359a05fc7f605",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "2dffc8c44b6e3347b3719c6419c07b4a18fea895",
                    "status": "affected",
                    "version": "610bfc6bc99bc83680d190ebc69359a05fc7f605",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "ad46c907d7d9975a285c1e89a4adde652eaa93f5",
                    "status": "affected",
                    "version": "610bfc6bc99bc83680d190ebc69359a05fc7f605",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "net/batman-adv/main.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "3.13"
                  },
                  {
                    "lessThan": "3.13",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.270",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.221",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.188",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.157",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.110",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.51",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.5",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3-rc1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbatman-adv: fix stale receive device on merged fragments\n\nFragment reassembly reuses the skb from the highest-numbered buffered\nfragment as the merged packet. When that fragment was received on a hard\ninterface which is deleted before the chain completes, the merged skb can\nre-enter the receive path with a stale skb-\u003edev and skb_iif.\n\nbatadv_batman_skb_recv() passes such merged packets through the normal\nreceive handlers again. DAT and bridge loop avoidance both derive the ARP\nheader length from skb-\u003edev, so they can dereference the freed net_device\nbefore the packet reaches the local mesh interface.\n\nRefresh the receive device metadata from the current receive device before\nrunning the packet handlers. This keeps internally reinjected merged\nfragments consistent with the normal receive path after hard interface\nteardown."
          }
        ],
        "id": "CVE-2026-89951",
        "lastModified": "2026-09-16T15:18:19.990",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "ADJACENT_NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 8.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-09-16T11:17:05.267",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/2dffc8c44b6e3347b3719c6419c07b4a18fea895"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/63d86250fa7cbe22451369bd1c0881dfc8190958"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/6df64825f8b199921120c685af2abca14b077331"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/a2c272da99c2077088083c14961cf2f1e4506995"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/ad46c907d7d9975a285c1e89a4adde652eaa93f5"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/e91d2cc7441d89a45bad73ad9789159c7441cb80"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/f4b4ae763b5d59319fad62a00c76676758e7dafa"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/f830c2dfc1431764db9256b3d5db1695fc9a7f56"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.