PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46233 Linux CVE debrief

A NULL pointer dereference vulnerability exists in the Linux kernel's batman-adv (Better Approach To Mobile Ad-hoc Networking) subsystem, specifically within the Bridge Loop Avoidance (BLA) component. The issue occurs in batadv_bla_purge_claims() when traversing claim entries with only rcu_read_lock() protection. A race condition with batadv_claim_put() can encounter a claim being concurrently released by batadv_claim_release(), where backbone_gw has been set to NULL prior to delayed RCU freeing. Subsequent calls to batadv_bla_claim_get_backbone_gw() on such a claim trigger a NULL pointer dereference. The fix ensures only claims with valid reference counters are purged, as claims already being released are handled by their own cleanup path.

Vendor
Linux
Product
Unknown
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-28
Original CVE updated
2026-05-28
Advisory published
2026-05-28
Advisory updated
2026-05-28

Who should care

Organizations running Linux kernels with batman-adv enabled, particularly mesh network deployments using Bridge Loop Avoidance. Relevant to network administrators, kernel maintainers, and security teams monitoring Linux networking subsystems.

Technical summary

The batman-adv mesh networking subsystem's Bridge Loop Avoidance (BLA) code contains a use-after-free adjacent vulnerability leading to NULL pointer dereference. The batadv_bla_purge_claims() function iterates over claim hash entries using RCU read-side critical sections without holding references to individual claims. Concurrent claim release via batadv_claim_put() → batadv_claim_release() can zero the backbone_gw pointer and schedule RCU-delayed freeing. If purge_claims() encounters such a claim before RCU grace period expires, calling batadv_bla_claim_get_backbone_gw() dereferences NULL. The resolution adds reference counting validation to skip claims already undergoing release.

Defensive priority

medium

Recommended defensive actions

  • Apply kernel patches from stable branches when available for your distribution
  • Monitor distribution security advisories for batman-adv package updates
  • If batman-adv BLA is not required, consider disabling the feature as a temporary mitigation
  • Review kernel logs for batman-adv related oops messages that may indicate exploitation attempts

Evidence notes

Vulnerability description sourced from official CVE record published 2026-05-28. Patch commits identified in NVD references for multiple stable kernel branches. No CVSS score or severity assigned by NVD at time of publication (status: Awaiting Analysis). Vendor attribution marked low confidence by source system due to 'Kernel' domain candidate; Linux kernel is the affected product.

Official resources

2026-05-28