Skip to main content

Linux Kernel EUVDEUVD-2026-38719

| CVE-2026-52916 MEDIUM
2026-06-24 Linux GHSA-7cg4-79f4-7w2g
Information Disclosure Linux Red Hat Suse
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
6.5 MEDIUM

Batman-adv is an adjacent-network layer 2 mesh protocol; any mesh participant sends crafted frames without credentials, causing pure kernel crash.

3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
5.3 MEDIUM
AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jul 08, 2026 - 16:01 vuln.today
CVSS changed
Jul 08, 2026 - 15:22 NVD
5.5 (MEDIUM)
Patch available
Jun 24, 2026 - 09:16 EUVD
CVE Published
Jun 24, 2026 - 07:14 cve.org
UNKNOWN (no severity yet)
CVE Published
Jun 24, 2026 - 07:14 nvd
MEDIUM 5.5

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

batman-adv: frag: disallow unicast fragment in fragment

batadv_frag_skb_buffer() is called by batadv_batman_skb_recv() when a BATADV_UNICAST_FRAG packet is received. Once all fragments are collected and the packet is reassembled, batadv_recv_frag_packet() calls batadv_batman_skb_recv() again to process the defragmented payload.

A malicious sender can craft a BATADV_UNICAST_FRAG packet whose reassembled payload is itself a BATADV_UNICAST_FRAG packet (matryoshka-style nesting). Each nesting level recurses through batadv_batman_skb_recv() without bound, growing the kernel stack until it is exhausted.

Since refragmentation or fragments in fragments are not actually allowed, discard all packets which are still BATADV_UNICAST_FRAG packets after the defragmentation process.

AnalysisAI

Stack exhaustion in the Linux kernel batman-adv mesh networking subsystem allows an attacker on the same batman-adv mesh to crash the kernel by sending matryoshka-nested BATADV_UNICAST_FRAG packets. The reassembled payload's packet type is not validated before re-processing, enabling unbounded recursion in batadv_batman_skb_recv() that exhausts kernel stack and causes a hard system crash. No active exploitation is recorded in CISA KEV and EPSS sits at 0.18% (7th percentile), making this a targeted DoS risk limited to environments running batman-adv mesh networking.

Technical ContextAI

B.A.T.M.A.N. Advanced (batman-adv) is a Linux kernel module implementing a layer 2 mesh networking protocol used in wireless community networks and IoT mesh deployments. When a BATADV_UNICAST_FRAG packet is received, batadv_frag_skb_buffer() collects packet fragments, reassembles them, and then calls batadv_batman_skb_recv() again to process the reconstructed payload. The flaw lies in the absence of post-reassembly type validation: the code does not check whether the reassembled payload is itself a BATADV_UNICAST_FRAG packet before passing it back through the same receive path. A crafted packet with arbitrarily deep nesting (matryoshka style) therefore triggers recursion into batadv_batman_skb_recv() without any depth limit, growing kernel stack frames until the stack is exhausted. The vulnerability was introduced at commit 610bfc6bc99bc83680d190ebc69359a05fc7f605, present since Linux 3.13. Though no CWE is assigned in the NVD entry, the root cause aligns with CWE-674 (Uncontrolled Recursion). Affected CPE: cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*.

RemediationAI

Vendor-released patches are available across all active stable kernel branches. Upgrade to one of the following fixed versions: 5.10.258, 5.15.209, 6.1.175, 6.6.142, 6.12.92, 6.18.34, 7.0.11, or any 7.1+ release. Individual fix commits are available at git.kernel.org/stable (see references for per-branch commit hashes). For systems that do not use batman-adv mesh networking, unloading and blacklisting the module is an effective compensating control with no operational side effects: run 'rmmod batman-adv' and add 'blacklist batman-adv' to /etc/modprobe.d/blacklist.conf. For systems that require batman-adv, restrict layer 2 mesh network access to trusted nodes only and apply the kernel patch as soon as distribution packages are available. No workaround that preserves full batman-adv functionality while blocking the attack exists until the patch is applied.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Image SLES15-SP7-Azure-3P Image SLES15-SP7-Azure-Basic Image SLES15-SP7-Azure-Standard Image SLES15-SP7-HPC-Azure Affected
Image SLES15-SP7-BYOS-Azure Image SLES15-SP7-BYOS-GCE Image SLES15-SP7-CHOST-BYOS-Aliyun Image SLES15-SP7-CHOST-BYOS-Azure Image SLES15-SP7-CHOST-BYOS-EC2 Image SLES15-SP7-CHOST-BYOS-GCE Image SLES15-SP7-CHOST-BYOS-GDC Image SLES15-SP7-CHOST-BYOS-SAP-CCloud Image SLES15-SP7-EC2 Image SLES15-SP7-EC2-ECS-HVM Image SLES15-SP7-GCE Image SLES15-SP7-HPC-BYOS-Azure Image SLES15-SP7-HPC-BYOS-EC2 Image SLES15-SP7-HPC-BYOS-GCE Image SLES15-SP7-Hardened-BYOS-Azure Image SLES15-SP7-Hardened-BYOS-EC2 Image SLES15-SP7-Hardened-BYOS-GCE Image SLES15-SP7-SAPCAL-Azure Image SLES15-SP7-SAPCAL-EC2 Image SLES15-SP7-SAPCAL-GCE Affected
Image SLES15-SP7-SAP-Azure Image SLES15-SP7-SAP-Azure-3P Image SLES15-SP7-SAP-BYOS-Azure Image SLES15-SP7-SAP-BYOS-EC2 Image SLES15-SP7-SAP-BYOS-GCE Image SLES15-SP7-SAP-EC2 Image SLES15-SP7-SAP-GCE Image SLES15-SP7-SAP-Hardened-Azure Image SLES15-SP7-SAP-Hardened-BYOS-Azure Image SLES15-SP7-SAP-Hardened-BYOS-EC2 Image SLES15-SP7-SAP-Hardened-BYOS-GCE Image SLES15-SP7-SAP-Hardened-GCE Affected
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed

Share

EUVD-2026-38719 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy