CVE-2026-52914: batman-adv: fix fragment reassembly length accounting

Synopsis

An integer truncation flaw in the batman-adv mesh-networking subsystem of the Linux kernel allows an unauthenticated remote attacker to corrupt fragment reassembly state. The vulnerability is reachable over the network with no privileges or user interaction required, as derived from the CVSS vector (AV:N/AC:L/PR:N/UI:N). Successful exploitation gives the attacker full read and write access to affected memory regions and the ability to crash the host, enabling remote code execution or denial of service. Patched-image rebuilds at fix versions 5.10.258 and 5.15.209 are available on HarborGuard for environments running an affected kernel version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the batman-adv network interface over the network; no local access is needed.

• AuthenticationNot required

  No credentials or account of any kind are required to send the malformed fragment chain that triggers the flaw.

• Victim interactionNot required

  The affected kernel processes incoming fragments without any action from a logged-in user or administrator.

• Attack complexityDetail

  Exploitation is reliable and condition-free; no race conditions, memory layout assumptions, or special environmental state are required.

Blast Radius

• Reads arbitrary kernel memory, exposing secrets such as session tokens, encryption keys, and process data.
• Writes to arbitrary kernel memory, allowing an attacker to overwrite security-critical data structures or inject code.
• Crashes the host by driving the reassembly path with corrupted length state, causing a kernel panic and full service disruption.
• All three impacts can be chained: an attacker who achieves memory control can escalate from crash to persistent code execution on the affected host.