Linux Kernel CVE-2026-46233

The vulnerability resides in the batman-adv kernel module (B.A.T.M.A.N. Advanced mesh networking protocol), specifically in the Bridge Loop Avoidance subsystem responsible for preventing Ethernet bridge loops across multi-homed mesh networks. batadv_bla_purge_claims() iterates the internal claim hash table using rcu_read_lock(), which serializes against RCU grace periods but does not block concurrent object modification. The parallel code path batadv_claim_put() → batadv_claim_release() sets backbone_gw to NULL as the first step of teardown, before the deferred RCU kfree() executes. Because the purge function performs no reference-count validity check before calling batadv_bla_claim_get_backbone_gw(), it can dereference a NULL pointer on a claim that is concurrently being freed. CWE-476 (NULL Pointer Dereference) applies, rooted in a classic TOCTOU race: the claim appears valid during list traversal but transitions to a partially-released state before use. CPE data confirms the affected product as cpe:2.3:o:linux:linux_kernel across multiple stable branches, with the vulnerable code introduced at commit 23721387c409087fd3b97e274f34d3ddc0970b74 (Linux 3.5 era).