CVE-2026-52931
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk32th percentile - higher than 32% of all known CVEs
Summary
In the Linux kernel, the batman-adv tp_meter module has a vulnerability where uninitialized sender-specific variables are used in batadv_tp_recv_ack() and batadv_tp_stop() when called on a receiver role. A malicious ACK packet can trigger undefined behavior.
Risk Assessment
An attacker can send a crafted ACK packet to a node acting as a receiver in a tp_meter session, causing unpredictable kernel behavior, potentially leading to system crash or security compromise.
Recommendation
Immediately update the Linux kernel to a version containing the fix that adds a role check before accessing sender fields. If updating is not possible, consider disabling the batman-adv module or restricting trusted connections.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: batman-adv: tp_meter: avoid use of uninit sender vars batadv_tp_recv_ack() and batadv_tp_stop() are only valid for tp_vars in the BATADV_TP_SENDER role. When called with a BATADV_TP_RECEIVER role, it proceeds to read sender-only members that were never initialized, leading to undefined behavior. This can be triggered when a node that is currently acting as a receiver in an ongoing tp_meter session receives a malicious ACK packet. Guard against this by checking tp_vars->role immediately after the lookup and bailing out if it is not BATADV_TP_SENDER, before any of those members are accessed.