CVE-2026-46208: batman-adv: stop tp_meter sessions during mesh teardown

Synopsis

A use-after-free race condition exists in the batman-adv mesh networking module of the Linux kernel. The flaw is reachable locally by a low-privileged user and requires no interaction from another user. Successful exploitation gives an attacker full read, write, and crash capability over the affected system. A patched-image rebuild at kernel version 6.6.140 (and the listed commit fixes) is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network access to the target is required.

• AuthenticationRequired

  Any low-privilege local account is sufficient to trigger the race condition during mesh interface teardown.

• Victim interactionNot required

  No other user needs to take any action; the attacker can trigger the race entirely on their own.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race-window timing, memory layout guessing, or other environmental conditions beyond having local access.

Blast Radius

• Reads protected kernel memory, including credentials, keying material, and data belonging to other processes.
• Writes to kernel memory structures, allowing privilege escalation or persistent manipulation of kernel state.
• Crashes the affected system by corrupting mesh teardown state, causing a kernel panic or oops.
• Any container or workload sharing the host kernel is exposed because the vulnerability lives in kernel space, not in a user-space process.