CVE-2026-52931: batman-adv: tp_meter: avoid use of uninit sender vars

Synopsis

This is a use-of-uninitialized-variable vulnerability in the Linux kernel's batman-adv mesh networking throughput-meter (tp_meter) subsystem. It is reachable over the network with no authentication required, and affects any node running batman-adv that is acting as a receiver in an active tp_meter session. A remote attacker who sends a crafted ACK packet to such a node can trigger undefined behavior by forcing the kernel to read sender-only state variables that were never initialized, enabling full read, write, and crash-level impact on the affected host. Patched-image rebuilds at fix versions 5.10.258 and 5.15.209 are available on HarborGuard for environments running an affected kernel version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the target node over the network; the vulnerable code path is triggered by a remotely sent crafted ACK packet.

• AuthenticationNot required

  No account or credential is needed; the malicious ACK packet can be sent by any unauthenticated network peer.

• Victim interactionNot required

  No action by a user on the target node is required; the exploit succeeds purely through receipt of the crafted packet.

• Attack complexityDetail

  Attack complexity is low; the exploit is reliable and requires no race condition, special memory layout, or environmental precondition beyond the target being in an active tp_meter receiver session.

Blast Radius

• A successful attacker causes the kernel to read uninitialized sender-only memory, which can expose sensitive kernel memory contents including cryptographic material, session state, or pointer values.
• The undefined behavior from accessing uninitialized variables allows arbitrary kernel memory writes, enabling an attacker to overwrite kernel data structures and escalate privileges or inject malicious code into kernel context.
• The attacker can crash the affected node entirely by corrupting kernel state through the uninitialized variable access, causing a kernel panic and full service disruption.