PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46233 Linux CVE debrief

A NULL pointer dereference vulnerability exists in the Linux kernel's batman-adv (Better Approach To Mobile Ad-hoc Networking) subsystem, specifically within the Bridge Loop Avoidance (BLA) component. The issue occurs in batadv_bla_purge_claims() when traversing claim entries with only rcu_read_lock() protection. A race condition with batadv_claim_put() can encounter a claim being concurrently released by batadv_claim_release(), where backbone_gw has been set to NULL prior to delayed RCU freeing. Subsequent calls to batadv_bla_claim_get_backbone_gw() on such a claim trigger a NULL pointer dereference. The fix ensures only claims with valid reference counters are purged, as claims already being released are handled by their own cleanup path.

Vendor
Linux
Product
Unknown
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-28
Original CVE updated
2026-06-10
Advisory published
2026-05-28
Advisory updated
2026-06-10

Who should care

Organizations running Linux kernels with batman-adv enabled, particularly mesh network deployments using Bridge Loop Avoidance. Relevant to network administrators, kernel maintainers, and security teams monitoring Linux networking subsystems.

Technical summary

The batman-adv mesh networking subsystem's Bridge Loop Avoidance (BLA) code contains a use-after-free adjacent vulnerability leading to NULL pointer dereference. The batadv_bla_purge_claims() function iterates over claim hash entries using RCU read-side critical sections without holding references to individual claims. Concurrent claim release via batadv_claim_put() → batadv_claim_release() can zero the backbone_gw pointer and schedule RCU-delayed freeing. If purge_claims() encounters such a claim before RCU grace period expires, calling batadv_bla_claim_get_backbone_gw() dereferences NULL. The resolution adds reference counting validation to skip claims already undergoing release.

Defensive priority

medium

Recommended defensive actions

  • Apply kernel patches from stable branches when available for your distribution
  • Monitor distribution security advisories for batman-adv package updates
  • If batman-adv BLA is not required, consider disabling the feature as a temporary mitigation
  • Review kernel logs for batman-adv related oops messages that may indicate exploitation attempts

Evidence notes

Vulnerability description sourced from official CVE record published 2026-05-28. Patch commits identified in NVD references for multiple stable kernel branches. No CVSS score or severity assigned by NVD at time of publication (status: Awaiting Analysis). Vendor attribution marked low confidence by source system due to 'Kernel' domain candidate; Linux kernel is the affected product.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-46233 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-46233

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-46233 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-46233

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/7b7ebb7222a5524ce58e48cc9c6d688320ea6cfe

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/7b8fbcee3184d848b5aee085ca16d0cf05c9b641

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/ab3dbd07a809a8eb30c7ddfab9ac886ed30dce8d

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/b65365d2b1e6095c538d49baeb140dd1c166c1b3

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/cf6b604011591865ae39ac82de8978c1120d17af

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.