CVE-2026-63835 Linux CVE debrief

Who should care

Linux kernel maintainers, network administrators, and users of Linux distributions are affected by this vulnerability. They should review and apply the provided kernel patches, disable the batman-adv module if not in use, and monitor kernel updates for affected Linux distributions.

Technical summary

The batman-adv module in the Linux kernel has a vulnerability where OGM aggregation is not properly prevented on disabled hardif. This can lead to a leak of skbs. The vulnerability is caused by the batadv_v_ogm_send_meshif() function still queuing new skbs to the aggr_list after the interface has been disabled. The batadv_v_ogm_iface_disable() function must block batadv_v_ogm_queue_on_if() to avoid leak of skbs.

Defensive priority

Medium

Recommended defensive actions

• Review and apply the provided kernel patches
• Disable batman-adv module if not in use
• Monitor kernel updates for affected Linux distributions
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

Evidence is limited; verify with official kernel sources and Linux distribution maintainers. The batman-adv module in the Linux kernel has a vulnerability where OGM aggregation is not properly prevented on disabled hardif. This can lead to a leak of skbs. Limited evidence is available; defenders should verify with official kernel sources and Linux distribution maintainers.

Official resources