CVE-2026-46212: batman-adv: bla: prevent use-after-free when deleting claims

Synopsis

A use-after-free vulnerability exists in the Linux kernel's batman-adv bridge loop avoidance (BLA) subsystem. An attacker on the same adjacent network segment can trigger the flaw without any authentication, exploiting a race between claim object de-reference and memory release in batadv_bla_del_backbone_claims(). Successful exploitation gives the attacker full read, write, and crash capability over the affected host. A patched-image rebuild is available on HarborGuard for environments running an affected kernel version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityDetail

  The attacker must be on the same adjacent network segment (LAN, VLAN, or VPN) as the target; remote exploitation over the open internet is not possible with this vector.

• AuthenticationNot required

  No account or credentials of any kind are required to attempt exploitation.

• Victim interactionNot required

  The attacker does not need to trick any user into performing an action; exploitation is entirely attacker-driven.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, special memory layout, or other environmental factors beyond adjacency.

Blast Radius

• Reads arbitrary kernel memory, exposing cryptographic keys, session tokens, and other sensitive in-memory data.
• Overwrites kernel memory structures, allowing the attacker to tamper with running processes or escalate to full kernel code execution.
• Crashes the affected host by corrupting freed memory, causing a kernel panic and complete service disruption.
• Any container or workload co-located on the host is exposed to the same impact because the vulnerability is at the kernel level.