CVE-2026-52931

batman-adv: tp_meter: avoid use of uninit sender vars

State: Published
Severity: 9.8 Critical
Published: Jun 24, 2026
Updated: Oct 19, 2026
Reserved: Jun 9, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

batman-adv: tp_meter: avoid use of uninit sender vars

batadv_tp_recv_ack() and batadv_tp_stop() are only valid for tp_vars in the BATADV_TP_SENDER role. When called with a BATADV_TP_RECEIVER role, it proceeds to read sender-only members that were never initialized, leading to undefined behavior.

This can be triggered when a node that is currently acting as a receiver in an ongoing tp_meter session receives a malicious ACK packet.

Guard against this by checking tp_vars->role immediately after the lookup and bailing out if it is not BATADV_TP_SENDER, before any of those members are accessed.

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

CWE-457 Use of Uninitialized Variable

Affected Products

Product	Versions
LinuxLinux	33a3bb4a3345bb511f9c69c913da95d4693e2a4e to before 0e388af04b3958b178a1b979527f93eb46ea1feeAffected 33a3bb4a3345bb511f9c69c913da95d4693e2a4e to before 1a21c055f66e78973712a4a1be2a554f1ee2e4f4Affected 33a3bb4a3345bb511f9c69c913da95d4693e2a4e to before 9884c9c02d3c90e9215db3c5128f59045d20ae91Affected 33a3bb4a3345bb511f9c69c913da95d4693e2a4e to before 53f931e0146ae5bdab4cba302646827d06b3794bAffected 33a3bb4a3345bb511f9c69c913da95d4693e2a4e to before ecdaa3e4d91040206afe21bc8a0d1198a0971ff3Affected 33a3bb4a3345bb511f9c69c913da95d4693e2a4e to before dc2ae5fbd2dadc26735092f140b246841d969a11Affected 33a3bb4a3345bb511f9c69c913da95d4693e2a4e to before 85397e48afe6be83ffca5ad3f4792296bfc81d3dAffected 33a3bb4a3345bb511f9c69c913da95d4693e2a4e to before 6c65cf23d4c6170fcf5714c32aa64689718cb142Affected
LinuxLinux	4.8Affected before 4.8Not affected 5.10.258 through 5.10.Not affected 5.15.209 through 5.15.Not affected 6.1.175 through 6.1.Not affected 6.6.142 through 6.6.Not affected 6.12.92 through 6.12.Not affected 6.18.34 through 6.18.Not affected 7.0.11 through 7.0.*Not affected 7.1 and laterNot affected

Product

Versions

LinuxLinux

33a3bb4a3345bb511f9c69c913da95d4693e2a4e to before 0e388af04b3958b178a1b979527f93eb46ea1feeAffected
33a3bb4a3345bb511f9c69c913da95d4693e2a4e to before 1a21c055f66e78973712a4a1be2a554f1ee2e4f4Affected
33a3bb4a3345bb511f9c69c913da95d4693e2a4e to before 9884c9c02d3c90e9215db3c5128f59045d20ae91Affected
33a3bb4a3345bb511f9c69c913da95d4693e2a4e to before 53f931e0146ae5bdab4cba302646827d06b3794bAffected
33a3bb4a3345bb511f9c69c913da95d4693e2a4e to before ecdaa3e4d91040206afe21bc8a0d1198a0971ff3Affected
33a3bb4a3345bb511f9c69c913da95d4693e2a4e to before dc2ae5fbd2dadc26735092f140b246841d969a11Affected
33a3bb4a3345bb511f9c69c913da95d4693e2a4e to before 85397e48afe6be83ffca5ad3f4792296bfc81d3dAffected
33a3bb4a3345bb511f9c69c913da95d4693e2a4e to before 6c65cf23d4c6170fcf5714c32aa64689718cb142Affected

LinuxLinux

4.8Affected
before 4.8Not affected
5.10.258 through 5.10.*Not affected
5.15.209 through 5.15.*Not affected
6.1.175 through 6.1.*Not affected
6.6.142 through 6.6.*Not affected
6.12.92 through 6.12.*Not affected
6.18.34 through 6.18.*Not affected
7.0.11 through 7.0.*Not affected
7.1 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.