CVE-2026-43382 batman-adv: Avoid double-rtnl_lock ELP metric worker
A race condition in the batman-adv kernel module can cause a deadlock, leading to a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-43382?
CVE-2026-43382 is a medium-severity vulnerability in Linux kernel, published on 8 May 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
batman-adv: Avoid double-rtnl_lock ELP metric worker
batadv_v_elp_get_throughput() might be called when the RTNL lock is already held. This could be problematic when the work queue item is cancelled via cancel_delayed_work_sync() in batadv_v_elp_iface_disable(). In this case, an rtnl_lock() would cause a deadlock.
To avoid this, rtnl_trylock() was used in this function to skip the retrieval of the ethtool information in case the RTNL lock was already held.
But for cfg80211 interfaces, batadv_get_real_netdev() was called - which also uses rtnl_lock(). The approach for __ethtool_get_link_ksettings() must also be used instead and the lockless version __batadv_get_real_netdev() has to be called.
Weakness: CWE-667
Which versions are affected by CVE-2026-43382?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-43382?
Apply the vendor's patch.
Is CVE-2026-43382 being exploited?
There is no known exploitation of CVE-2026-43382 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2026-43382, DEBIAN-CVE-2026-43382, GHSA-36qq-553f-w4ww, ROOT-OS-DEBIAN-11-CVE-2026-43382, ROOT-OS-UBUNTU-2204-CVE-2026-43382, ROOT-OS-UBUNTU-2404-CVE-2026-43382 and 1 more.