CVE-2026-52916

batman-adv: frag: disallow unicast fragment in fragment

State: Published
Severity: Not scored
Published: Jun 24, 2026
Updated: Jun 24, 2026
Reserved: Jun 9, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

batman-adv: frag: disallow unicast fragment in fragment

batadv_frag_skb_buffer() is called by batadv_batman_skb_recv() when a BATADV_UNICAST_FRAG packet is received. Once all fragments are collected and the packet is reassembled, batadv_recv_frag_packet() calls batadv_batman_skb_recv() again to process the defragmented payload.

A malicious sender can craft a BATADV_UNICAST_FRAG packet whose reassembled payload is itself a BATADV_UNICAST_FRAG packet (matryoshka-style nesting). Each nesting level recurses through batadv_batman_skb_recv() without bound, growing the kernel stack until it is exhausted.

Since refragmentation or fragments in fragments are not actually allowed, discard all packets which are still BATADV_UNICAST_FRAG packets after the defragmentation process.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	610bfc6bc99bc83680d190ebc69359a05fc7f605 to before 0c208fa3859e3a33a1c38bebc41d021166e94ac8Affected 610bfc6bc99bc83680d190ebc69359a05fc7f605 to before bcda4814dc6524283c0b958882cb963d75fe411dAffected 610bfc6bc99bc83680d190ebc69359a05fc7f605 to before aea54d0bbe156d5ab7d00d68f66149ff41f4612aAffected 610bfc6bc99bc83680d190ebc69359a05fc7f605 to before b54e459cf86943583c1aa2ee3081874e7ab1f5f3Affected 610bfc6bc99bc83680d190ebc69359a05fc7f605 to before 5418be6c2e117bf8a316582795a8e3ff90f45e5dAffected 610bfc6bc99bc83680d190ebc69359a05fc7f605 to before 5895ad21c7059a652da83fb817510f7a1e962abfAffected 610bfc6bc99bc83680d190ebc69359a05fc7f605 to before 7138c35c9ad39a2fca6264af6b87466471f04ffcAffected 610bfc6bc99bc83680d190ebc69359a05fc7f605 to before bc62216dc8e221e3781afa14430f45208bfa9af9Affected
LinuxLinux	3.13Affected before 3.13Not affected 5.10.258 through 5.10.Not affected 5.15.209 through 5.15.Not affected 6.1.175 through 6.1.Not affected 6.6.142 through 6.6.Not affected 6.12.92 through 6.12.Not affected 6.18.34 through 6.18.Not affected 7.0.11 through 7.0.*Not affected 7.1 and laterNot affected

Product

Versions

LinuxLinux

610bfc6bc99bc83680d190ebc69359a05fc7f605 to before 0c208fa3859e3a33a1c38bebc41d021166e94ac8Affected
610bfc6bc99bc83680d190ebc69359a05fc7f605 to before bcda4814dc6524283c0b958882cb963d75fe411dAffected
610bfc6bc99bc83680d190ebc69359a05fc7f605 to before aea54d0bbe156d5ab7d00d68f66149ff41f4612aAffected
610bfc6bc99bc83680d190ebc69359a05fc7f605 to before b54e459cf86943583c1aa2ee3081874e7ab1f5f3Affected
610bfc6bc99bc83680d190ebc69359a05fc7f605 to before 5418be6c2e117bf8a316582795a8e3ff90f45e5dAffected
610bfc6bc99bc83680d190ebc69359a05fc7f605 to before 5895ad21c7059a652da83fb817510f7a1e962abfAffected
610bfc6bc99bc83680d190ebc69359a05fc7f605 to before 7138c35c9ad39a2fca6264af6b87466471f04ffcAffected
610bfc6bc99bc83680d190ebc69359a05fc7f605 to before bc62216dc8e221e3781afa14430f45208bfa9af9Affected

LinuxLinux

3.13Affected
before 3.13Not affected
5.10.258 through 5.10.*Not affected
5.15.209 through 5.15.*Not affected
6.1.175 through 6.1.*Not affected
6.6.142 through 6.6.*Not affected
6.12.92 through 6.12.*Not affected
6.18.34 through 6.18.*Not affected
7.0.11 through 7.0.*Not affected
7.1 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.