Linux Kernel CVE-2026-31657

Primary fix: upgrade to patched kernel versions 6.1.169, 6.6.135, 6.12.82, 6.18.23, 6.19.13, or 7.0+ depending on your stable branch. Patches introduce proper reference counting via batadv_bla_claim_get_backbone_gw() to prevent use-after-free during concurrent claim operations. For systems requiring batman-adv but unable to immediately patch, temporary workaround is to disable Bridge Loop Avoidance via 'batctl bridge_loop_avoidance 0' on all mesh nodes - this eliminates the vulnerable code path but removes loop protection, requiring network topology redesign to avoid bridging loops manually (do not connect mesh to multiple LAN segments). This workaround severely limits deployment flexibility and is only viable for simple tree topologies. Alternatively, unload batman-adv module entirely if mesh networking is not mission-critical ('rmmod batman_adv'), but this disables all mesh functionality. For distributions, check vendor security advisories: Debian DSA/DLA, Ubuntu USN, RHEL RHSA, SUSE updates will backport fixes to their kernel packages. Verify patch application with 'grep batadv_bla_claim_get_backbone_gw /proc/kallsyms' (should show the new function). No kernel command-line mitigations exist for this vulnerability.