CVE-2026-31657

Summary

In the Linux kernel, the following vulnerability has been resolved:

batman-adv: hold claim backbone gateways by reference

batadv_bla_add_claim() can replace claim->backbone_gw and drop the old gateway's last reference while readers still follow the pointer.

The netlink claim dump path dereferences claim->backbone_gw->orig and takes claim->backbone_gw->crc_lock without pinning the underlying backbone gateway. batadv_bla_check_claim() still has the same naked pointer access pattern.

Reuse batadv_bla_claim_get_backbone_gw() in both readers so they operate on a stable gateway reference until the read-side work is complete. This keeps the dump and claim-check paths aligned with the lifetime rules introduced for the other BLA claim readers.

Affected Software

VendorProductVersion RangeStatus
LinuxLinux23721387c409087fd3b97e274f34d3ddc0970b74 < 5202f071b367ffbc8e279fc7a00db14f5e587f52affected
LinuxLinux23721387c409087fd3b97e274f34d3ddc0970b74 < 69d1ce9c72eca91203ffdb8d08bacd511100aec6affected
LinuxLinux23721387c409087fd3b97e274f34d3ddc0970b74 < f4858832ddef2f39f21e30b7226bbcd3c4b2bc96affected
LinuxLinux23721387c409087fd3b97e274f34d3ddc0970b74 < 2f55b58b5a0bbed192d60c444a45a49cdf1b545faffected
LinuxLinux23721387c409087fd3b97e274f34d3ddc0970b74 < 7962b522222628596ca9ecc8722efc95367aadbdaffected
LinuxLinux23721387c409087fd3b97e274f34d3ddc0970b74 < 4dee4c0688443aaf5bbec74aa203c851d1d53c35affected
LinuxLinux23721387c409087fd3b97e274f34d3ddc0970b74 < 1f2dc36c297d27733f1b380ea644cf15a361bd7baffected
LinuxLinux23721387c409087fd3b97e274f34d3ddc0970b74 < 82d8701b2c930d0e96b0dbc9115a218d791cb0d2affected
LinuxLinux3.5affected
LinuxLinux0 < 3.5unaffected
LinuxLinux5.10.258 <= 5.10.*unaffected
LinuxLinux5.15.209 <= 5.15.*unaffected
LinuxLinux6.1.169 <= 6.1.*unaffected
LinuxLinux6.6.135 <= 6.6.*unaffected
LinuxLinux6.12.82 <= 6.12.*unaffected
LinuxLinux6.18.23 <= 6.18.*unaffected
LinuxLinux6.19.13 <= 6.19.*unaffected
LinuxLinux7.0 <= *unaffected

Weaknesses

References