CVE-2026-46206: batman-adv: reject new tp_meter sessions during teardown

Synopsis

A use-after-free or race-condition flaw exists in the Linux kernel's batman-adv mesh networking subsystem, specifically in the tp_meter component. An attacker with a low-privilege local account can trigger the vulnerability by initiating new throughput-meter sessions during the mesh interface teardown sequence, after the mesh state has left BATADV_MESH_ACTIVE. Successful exploitation grants full read, write, and crash capability over the affected kernel context. A patched-image rebuild at the fix versions (6.6.140, 6.12.90, 6.18.32, and the corresponding commit for each stable branch) is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network-facing service exposure is required.

• AuthenticationRequired

  Any low-privilege local account is sufficient; no administrative or root credentials are needed to trigger the vulnerable code path.

• Victim interactionNot required

  No user interaction is required; the attacker can execute the exploit entirely on their own.

• Attack complexityDetail

  Exploit reliability is high and no special environmental conditions, race wins, or memory-layout dependencies are noted in the CVSS scoring.

Blast Radius

• Reads arbitrary kernel memory, exposing credentials, cryptographic material, or other sensitive data held in kernel space.
• Writes to kernel memory structures, allowing modification of security-relevant kernel state or persisted data.
• Crashes the affected kernel, taking down the entire host and all workloads running on it.
• The scope is contained to the compromised host (CVSS Scope:Unchanged), so lateral movement requires a separate step.