Skip to main content

Linux Kernel CVE-2026-52931

| EUVDEUVD-2026-38701 CRITICAL
Use of Uninitialized Variable (CWE-457)
2026-06-24 Linux GHSA-xwx9-x5x2-3cmw
Information Disclosure Linux
Critical
Disputed · 9.8 Vendor: Linux
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Join or spoof batman-adv mesh node
  2. Delivery
    Identify victim in active tp_meter receiver session
  3. Exploit
    Send crafted malicious tp_meter ACK
  4. Execution
    Kernel runs sender-only path on uninit vars
  5. Impact
    Leak kernel memory or crash node

Vulnerability Assessment

Weakness
CWE
CWE-457
ASVS 5.0
V15 - Secure Coding and Architecture Variable initialization checks
Exploitation Conditions

Exploitation requires the batman-adv module to be loaded and the target node to be an active participant in an ongoing tp_meter (throughput meter) session in the BATADV_TP_RECEIVER role; the attacker must be able to inject a crafted tp_meter ACK packet onto the same layer-2 batman-adv mesh that reaches the victim. Limiting factors: the bug is only reachable on kernels that compile and load batman-adv (not a default for most server/desktop deployments), only while a tp_meter session is live, only against the receiver side, and only from a node with mesh-level (adjacent L2) reach - there is no path from a routed/internet-only attacker. No user interaction by the victim's operator is required beyond having the tp_meter session active.
Impact

The signals are sharply conflicting. The published CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, base 9.8 Critical) overstates real-world risk: this is the common pattern for automated Linux kernel CVE scoring. The description makes clear that exploitation requires the target to already be an active tp_meter receiver inside an ongoing batman-adv mesh session, and the malicious ACK must arrive over that L2 mesh - conditions far more restrictive than unauthenticated internet-facing RCE. EPSS agrees, scoring just 0.17% (6th percentile), and the CVE is NOT in CISA KEV. The vendor tag labels the impact 'Information Disclosure' rather than code execution, which is consistent with reading uninitialized memory; the most likely practical outcomes are kernel memory disclosure or a denial of service (panic/oops), not reliable arbitrary code execution as the C:H/I:H/A:H vector implies. Net assessment: low-to-moderate real-world priority despite the 9.8 headline. Patch promptly on systems that actually run batman-adv mesh with tp_meter; for the vast majority of deployments where batman-adv is not loaded, this is not exploitable. Discrepancy to verify: CVSS claims AV:N/AC:L but the description implies adjacent mesh access plus an active receiver session, i.e., effectively AV:A/AC:H.
Exploit ScenarioDerived

An attacker who has joined or spoofed a node on a batman-adv mesh waits for (or induces) a victim node to participate as a tp_meter receiver, then sends a crafted/malicious tp_meter ACK packet. The victim's kernel runs sender-only ACK-handling logic against the receiver session, dereferencing uninitialized tp_vars members and leaking kernel memory or panicking. No public proof-of-concept is currently identified, and the relatively high attack complexity (an active receiver session is required) makes opportunistic exploitation unlikely.
Act Now Prioritize within 24-48h. Why: CRITICAL severity.
Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jun 28, 2026

Use of uninitialized sender variables in the Linux kernel's batman-adv (B.A.T.M.A.N. Advanced) mesh networking module allows a malicious mesh peer to trigger undefined behavior on a node acting as a tp_meter receiver. When such a node receives a crafted ACK packet, batadv_tp_recv_ack() and batadv_tp_stop() execute sender-only code paths that read tp_vars members never initialized for the receiver role, potentially leaking memory contents or crashing the kernel. No public exploit identified at time of analysis; EPSS probability is low (0.17%, 6th percentile) and the issue is not in CISA KEV, but a vendor patch is available across multiple stable trees.

RemediationAI

Apply the vendor-released stable kernel updates: upgrade to 5.10.258, 5.15.209, 6.1.175, 6.6.142, 6.12.92, 6.18.34, 7.0.11, 7.1, or later as appropriate to your branch (Vendor-released patch: see fixed versions above), and reboot. Distribution users should install the corresponding distro kernel update once it incorporates these commits; the upstream fixes are at https://git.kernel.org/stable/c/0e388af04b3958b178a1b979527f93eb46ea1fee and the sibling commits listed in the EUVD. If immediate patching is not possible, the most effective compensating control is to avoid loading the vulnerable code: do not load the batman-adv module (blacklist it via modprobe) on systems that do not require mesh networking, which fully removes the attack surface but disables B.A.T.M.A.N. mesh functionality. Where batman-adv is required, avoid initiating or running tp_meter throughput-measurement sessions and restrict mesh membership to trusted nodes (e.g., authenticated/encrypted mesh links), accepting that this limits ad-hoc mesh participation. Reference the NVD advisory at https://nvd.nist.gov/vuln/detail/CVE-2026-52931 for tracking.

Affected VersionsENISA

Linux 4.8
Linux 33a3bb4a3345bb511f9c69c913da95d4693e2a4e <1a21c055f66e78973712a4a1be2a554f1ee2e4f4
Linux 33a3bb4a3345bb511f9c69c913da95d4693e2a4e <0e388af04b3958b178a1b979527f93eb46ea1fee
Linux patch: 7.1
Linux patch: 5.10.258
Linux patch: 6.1.175
Linux 33a3bb4a3345bb511f9c69c913da95d4693e2a4e <6c65cf23d4c6170fcf5714c32aa64689718cb142
Linux 33a3bb4a3345bb511f9c69c913da95d4693e2a4e <9884c9c02d3c90e9215db3c5128f59045d20ae91
Linux 33a3bb4a3345bb511f9c69c913da95d4693e2a4e <dc2ae5fbd2dadc26735092f140b246841d969a11
Linux patch: 6.18.34
Linux patch: 6.12.92
Linux patch: 5.15.209
Linux patch: 7.0.11
Linux 33a3bb4a3345bb511f9c69c913da95d4693e2a4e <53f931e0146ae5bdab4cba302646827d06b3794b
Linux 33a3bb4a3345bb511f9c69c913da95d4693e2a4e <ecdaa3e4d91040206afe21bc8a0d1198a0971ff3
Linux 33a3bb4a3345bb511f9c69c913da95d4693e2a4e <85397e48afe6be83ffca5ad3f4792296bfc81d3d
Linux patch: 6.6.142
Linux patch: 0

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

batman-adv is the in-kernel implementation of the B.A.T.M.A.N. mesh routing protocol, operating at layer 2 to build self-configuring wireless/wired mesh networks. Its tp_meter (throughput meter) subsystem measures link throughput between mesh nodes using a sender/receiver state machine, where each session is tracked in a tp_vars structure tagged with either BATADV_TP_SENDER or BATADV_TP_RECEIVER. The functions batadv_tp_recv_ack() and batadv_tp_stop() are only logically valid for sender-role sessions and assume sender-specific fields are populated. The root cause is a type-confusion/state-confusion bug in the CWE-457/CWE-908 class (use of uninitialized variable / use of uninitialized resource) - the CWE field is listed as N/A in the source data - where a receiver-role tp_vars is processed through sender-only logic, dereferencing fields that were never set up for that role. The affected component is the Linux kernel networking stack (CPE cpe:2.3:a:linux:linux:*), specifically the net/batman-adv tp_meter code introduced when tp_meter landed in kernel 4.8.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Sources disagree (Medium–Critical)
Vendor (Linux) PRIMARY 9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI 4.2 MEDIUM

Requires adjacent mesh reach and an active tp_meter receiver session (AV:A/AC:H); uninitialized reads yield limited memory disclosure (C:L) and possible kernel crash (A:L), no integrity impact.

3.1 AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L
4.0 AV:A/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N
SUSE 5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Linux

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

4
CVSS changed
Jun 28, 2026 - 08:22 NVD
9.8 (CRITICAL)
Patch available
Jun 24, 2026 - 09:16 EUVD
CVE Published
Jun 24, 2026 - 07:14 cve.org
UNKNOWN (no severity yet)
CVE Published
Jun 24, 2026 - 07:14 cve.org
CRITICAL 9.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

batman-adv: tp_meter: avoid use of uninit sender vars

batadv_tp_recv_ack() and batadv_tp_stop() are only valid for tp_vars in the BATADV_TP_SENDER role. When called with a BATADV_TP_RECEIVER role, it proceeds to read sender-only members that were never initialized, leading to undefined behavior.

This can be triggered when a node that is currently acting as a receiver in an ongoing tp_meter session receives a malicious ACK packet.

Guard against this by checking tp_vars->role immediately after the lookup and bailing out if it is not BATADV_TP_SENDER, before any of those members are accessed.

Executive ViewAI

Why It Matters

A critical vulnerability in the Linux kernel's batman-adv mesh networking module allows remote mesh peers to trigger memory information leaks or kernel crashes on nodes operating in receiver mode. Organizations deploying B.A.T.M.A.N. Advanced mesh networks face risk of service disruption and potential sensitive data exposure. A vendor patch is available across multiple stable kernel trees.

Business Impact: High
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.2%
Top 94% exploitable
Prevalence
Low
batman-adv mesh module rarely compiled or loaded in production kernels
Social Media
1
Sightings
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS MSRC Vendor CIRCL VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity CRITICAL
CISA KEV No
Public POC No
EPSS 0.2%
Patch available Yes
Active threat No
Deciding rule
CRITICAL severity
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Open
Automatable· derived
Yes
Human Impact
High

Priority Score

49
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +49
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Same weakness CWE-457 – Use of Uninitialized Variable

View all
CVE-2021-40418 CRITICAL POC
9.8
CVE-2021-3928 HIGH POC
7.8
CVE-2024-21502 HIGH POC
7.5
CVE-2026-22188 MEDIUM POC
6.9
CVE-2024-47540 CRITICAL
9.8
CVE-2026-72020 CRITICAL
9.8
CVE-2026-6748 CRITICAL
9.8
CVE-2026-78935 CRITICAL
9.6

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Image SLES15-SP7-Azure-3P Image SLES15-SP7-Azure-Basic Image SLES15-SP7-Azure-Standard Image SLES15-SP7-HPC-Azure Affected
Image SLES15-SP7-BYOS-Azure Image SLES15-SP7-BYOS-GCE Image SLES15-SP7-CHOST-BYOS-Aliyun Image SLES15-SP7-CHOST-BYOS-Azure Image SLES15-SP7-CHOST-BYOS-EC2 Image SLES15-SP7-CHOST-BYOS-GCE Image SLES15-SP7-CHOST-BYOS-GDC Image SLES15-SP7-CHOST-BYOS-SAP-CCloud Image SLES15-SP7-EC2 Image SLES15-SP7-EC2-ECS-HVM Image SLES15-SP7-GCE Image SLES15-SP7-HPC-BYOS-Azure Image SLES15-SP7-HPC-BYOS-EC2 Image SLES15-SP7-HPC-BYOS-GCE Image SLES15-SP7-Hardened-BYOS-Azure Image SLES15-SP7-Hardened-BYOS-EC2 Image SLES15-SP7-Hardened-BYOS-GCE Image SLES15-SP7-SAPCAL-Azure Image SLES15-SP7-SAPCAL-EC2 Image SLES15-SP7-SAPCAL-GCE Affected
Image SLES15-SP7-SAP-Azure Image SLES15-SP7-SAP-Azure-3P Image SLES15-SP7-SAP-BYOS-Azure Image SLES15-SP7-SAP-BYOS-EC2 Image SLES15-SP7-SAP-BYOS-GCE Image SLES15-SP7-SAP-EC2 Image SLES15-SP7-SAP-GCE Image SLES15-SP7-SAP-Hardened-Azure Image SLES15-SP7-SAP-Hardened-BYOS-Azure Image SLES15-SP7-SAP-Hardened-BYOS-EC2 Image SLES15-SP7-SAP-Hardened-BYOS-GCE Image SLES15-SP7-SAP-Hardened-GCE Affected
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-52931 ADVISORY https://ubuntu.com/security/notices/USN-8566-1 ADVISORY https://ubuntu.com/security/notices/USN-8568-1 ADVISORY https://vuldb.com/vuln/373195 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:3130/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:3166/ REF https://git.kernel.org/stable/c/0e388af04b3958b178a1b979527f93eb46ea1fee REF https://git.kernel.org/stable/c/1a21c055f66e78973712a4a1be2a554f1ee2e4f4 REF https://git.kernel.org/stable/c/53f931e0146ae5bdab4cba302646827d06b3794b REF https://git.kernel.org/stable/c/6c65cf23d4c6170fcf5714c32aa64689718cb142 REF https://git.kernel.org/stable/c/85397e48afe6be83ffca5ad3f4792296bfc81d3d REF https://git.kernel.org/stable/c/9884c9c02d3c90e9215db3c5128f59045d20ae91 REF https://git.kernel.org/stable/c/dc2ae5fbd2dadc26735092f140b246841d969a11 REF https://git.kernel.org/stable/c/ecdaa3e4d91040206afe21bc8a0d1198a0971ff3

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy