CVE-2026-46238: batman-adv: stop caching unowned originator pointers in BAT IV

Synopsis

A use-after-free vulnerability exists in the batman-adv mesh networking subsystem of the Linux kernel. The BAT IV routing algorithm cached an originator pointer inside neighbor-node state without owning a reference to it; after purge handling reclaimed the originator entry, the stale pointer remained accessible, allowing memory corruption. An attacker on the same adjacent network segment, with no authentication required, can exploit this to read memory contents, corrupt kernel data structures, or crash the host. Patched-image rebuilds at Linux kernel versions 6.6.140, 6.12.90, and 6.18.32 are available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityDetail

  The attacker must be on the same adjacent network, such as a LAN, wireless segment, or VPN, to reach a host running the vulnerable batman-adv interface; remote exploitation over the general internet is not possible.

• AuthenticationNot required

  No authentication or account credentials of any kind are needed to trigger the vulnerability.

• Victim interactionNot required

  Exploitation is fully attacker-driven; no user or administrator action on the target host is required.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other environmental factors outside the attacker's control.

Blast Radius

• A successful attacker reads arbitrary kernel memory from the affected host, exposing credentials, cryptographic keys, or other sensitive data held in kernel space.
• The attacker writes to freed memory, corrupting kernel data structures and enabling privilege escalation or arbitrary code execution in kernel context.
• The attacker triggers a kernel panic or oops, crashing the host and causing a denial of service for all workloads running on it.
• Any container or VM sharing the affected kernel is exposed to the same impact, not only the process that handles batman-adv traffic.