CVE-2026-89948 batman-adv: bla: fix freeing of claims on meshif deletion
A use-after-free vulnerability in the Linux kernel's batman-adv module allows attackers to cause a denial of service or potentially execute code during mesh interface deletion.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-89948?
CVE-2026-89948 is an use after free vulnerability in Linux, published on 16 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
batman-adv: bla: fix freeing of claims on meshif deletion
When the mesh interface is getting deleted, then batadv_bla_del_backbone_claims() (via batadv_bla_purge_backbone_gw()) could make sure that all claims gets removed. But this function is only executed when bat_priv->bla.claim_hash is not NULL. And since batadv_bla_free() is always setting it to NULL before it is (indirectly) called, it was never actually executed.
But the batadv_bla_purge_claims() -> batadv_handle_unclaim() is at the moment too fragile because the BLA code is not handling the rehashing in batadv_bla_update_orig_address(). The stored backbone address doesn't have to be the one actually used for the hash bucket selection during the initial adding of the backbone. The batadv_handle_unclaim() can therefore fail to find the respective backbone for the unclaim and then stop the deletion.
But the actual backbone_gw object is not needed for the unclaim because all relevant information is always provided by the caller. And the check for the existence of the backbone_gw doesn't provide any additional security check for the deletion of a claim.
Which versions are affected by CVE-2026-89948?
How do I fix CVE-2026-89948?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-89948 being exploited?
There is no known exploitation of CVE-2026-89948 in the wild and no public exploit code.
Sources
Also known as AZL-101697, BELL-CVE-2026-89948, DEBIAN-CVE-2026-89948, GHSA-9m5r-cr5m-2hhr, UBUNTU-CVE-2026-89948.