What is the CVSS score of EUVD-2026-38722?

EUVD-2026-38722 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux are affected by EUVD-2026-38722?

A local privilege escalation vulnerability in the Linux batman-adv mesh networking module (CVE-2026-52919, CVSS 7.8) could enable local users to execute arbitrary code with elevated privileges.. A patch is available.

How to fix or mitigate EUVD-2026-38722?

Within 24 hours: Identify all systems running the Linux kernel batman-adv module and document which allow local user access. Within 7 days: Deploy the kernel security patch for batman-adv (CVE-2026-52919) available per vendor advisory via change management. Within 30 days: Verify patch application across 100% of affected infrastructure and validate service continuity.

Linux EUVD-2026-38722

| CVE-2026-52919 HIGH

Integer Underflow (CWE-191)

2026-06-24 Linux

GHSA-428c-jvg5-r285

Linux Information Disclosure Integer Overflow

7.8

CVSS 3.1 · Vendor: Linux

Severity by source

Vendor (Linux) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (Linux) · only source for this CVE.

CVSS VectorVendor: Linux

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 28, 2026 - 08:22 vuln.today

CVSS changed

Jun 28, 2026 - 08:22 NVD

7.8 (HIGH)

Patch available

Jun 24, 2026 - 09:16 EUVD

CVE Published

Jun 24, 2026 - 07:14 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 24, 2026 - 07:14 cve.org

HIGH 7.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

batman-adv: fix tp_meter counter underflow during shutdown

batadv_tp_sender_shutdown() unconditionally decrements the "sending" atomic counter. If multiple paths (e.g. timeout, user cancel, and normal finish) call this function, the counter can underflow to -1.

Since the sender logic treats any non-zero value as "still sending", a negative value causes the sender kthread to loop indefinitely. This leads to a use-after-free when the interface is removed while the zombie thread is still active.

Fix this by using atomic_xchg() to ensure the counter only transitions from 1 to 0 once.

[sven: added missing change in batadv_tp_send]

AnalysisAI

Local privilege escalation via use-after-free in the Linux kernel's batman-adv (B.A.T.M.A.N. advanced) mesh networking module allows a local low-privileged user to crash or potentially gain code execution by triggering a tp_meter counter underflow during interface shutdown. …