CVE-2026-46233

Summary

In the Linux kernel, the following vulnerability has been resolved:

batman-adv: bla: only purge non-released claims

When batadv_bla_purge_claims() goes through the list of claims, it is only traversing the hash list with an rcu_read_lock(). Due to a potential parallel batadv_claim_put(), it can happen that it encounters a claim which was actually in the process of being released+freed by batadv_claim_release(). In this case, backbone_gw is set to NULL before the delayed RCU kfree is started. Calling batadv_bla_claim_get_backbone_gw() is then no longer allowed because it would cause a NULL-ptr derefence.

To avoid this, only claims with a valid reference counter must be purged. All others are already taken care of.

Affected Software

VendorProductVersion RangeStatus
LinuxLinux23721387c409087fd3b97e274f34d3ddc0970b74 < a9f58d5e3261f3deeae69ec1e237f38ef3ff5cbeaffected
LinuxLinux23721387c409087fd3b97e274f34d3ddc0970b74 < 6725c523a35eeca611ff37e7d4a8712fae92aefdaffected
LinuxLinux23721387c409087fd3b97e274f34d3ddc0970b74 < afb5436f6028fd68f408f189230fbaa19c910d72affected
LinuxLinux23721387c409087fd3b97e274f34d3ddc0970b74 < 7b8fbcee3184d848b5aee085ca16d0cf05c9b641affected
LinuxLinux23721387c409087fd3b97e274f34d3ddc0970b74 < 7b7ebb7222a5524ce58e48cc9c6d688320ea6cfeaffected
LinuxLinux23721387c409087fd3b97e274f34d3ddc0970b74 < b65365d2b1e6095c538d49baeb140dd1c166c1b3affected
LinuxLinux23721387c409087fd3b97e274f34d3ddc0970b74 < ab3dbd07a809a8eb30c7ddfab9ac886ed30dce8daffected
LinuxLinux23721387c409087fd3b97e274f34d3ddc0970b74 < cf6b604011591865ae39ac82de8978c1120d17afaffected
LinuxLinux3.5affected
LinuxLinux0 < 3.5unaffected
LinuxLinux5.10.258 <= 5.10.*unaffected
LinuxLinux5.15.209 <= 5.15.*unaffected
LinuxLinux6.1.175 <= 6.1.*unaffected
LinuxLinux6.6.140 <= 6.6.*unaffected
LinuxLinux6.12.90 <= 6.12.*unaffected
LinuxLinux6.18.32 <= 6.18.*unaffected
LinuxLinux7.0.9 <= 7.0.*unaffected
LinuxLinux7.1 <= *unaffected

Weaknesses

References