CVE-2026-52931 batman-adv: tp_meter: avoid use of uninit sender vars
A malicious ACK packet can trigger undefined behavior in the Linux kernel's batman-adv module, potentially causing a crash or code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-52931?
CVE-2026-52931 is a critical use after free vulnerability in Linux kernel, published on 24 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
batman-adv: tp_meter: avoid use of uninit sender vars
batadv_tp_recv_ack() and batadv_tp_stop() are only valid for tp_vars in the BATADV_TP_SENDER role. When called with a BATADV_TP_RECEIVER role, it proceeds to read sender-only members that were never initialized, leading to undefined behavior.
This can be triggered when a node that is currently acting as a receiver in an ongoing tp_meter session receives a malicious ACK packet.
Guard against this by checking tp_vars->role immediately after the lookup and bailing out if it is not BATADV_TP_SENDER, before any of those members are accessed.
Weakness: CWE-457
Which versions are affected by CVE-2026-52931?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-52931?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-52931 being exploited?
There is no known exploitation of CVE-2026-52931 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-90561, BELL-CVE-2026-52931, DEBIAN-CVE-2026-52931, GHSA-xwx9-x5x2-3cmw, ROOT-OS-DEBIAN-11-CVE-2026-52931, ROOT-OS-DEBIAN-12-CVE-2026-52931 and 3 more.