CVE-2026-89951

batman-adv: fix stale receive device on merged fragments

State: Published
Severity: 8.8 High
Published: Sep 16, 2026
Updated: Oct 19, 2026
Reserved: Sep 11, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

batman-adv: fix stale receive device on merged fragments

Fragment reassembly reuses the skb from the highest-numbered buffered fragment as the merged packet. When that fragment was received on a hard interface which is deleted before the chain completes, the merged skb can re-enter the receive path with a stale skb->dev and skb_iif.

batadv_batman_skb_recv() passes such merged packets through the normal receive handlers again. DAT and bridge loop avoidance both derive the ARP header length from skb->dev, so they can dereference the freed net_device before the packet reaches the local mesh interface.

Refresh the receive device metadata from the current receive device before running the packet handlers. This keeps internally reinjected merged fragments consistent with the normal receive path after hard interface teardown.

Scores

CVSS	Score	Vector	Source
3.1	8.8 High	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	610bfc6bc99bc83680d190ebc69359a05fc7f605 to before 63d86250fa7cbe22451369bd1c0881dfc8190958Affected 610bfc6bc99bc83680d190ebc69359a05fc7f605 to before f830c2dfc1431764db9256b3d5db1695fc9a7f56Affected 610bfc6bc99bc83680d190ebc69359a05fc7f605 to before f4b4ae763b5d59319fad62a00c76676758e7dafaAffected 610bfc6bc99bc83680d190ebc69359a05fc7f605 to before 6df64825f8b199921120c685af2abca14b077331Affected 610bfc6bc99bc83680d190ebc69359a05fc7f605 to before a2c272da99c2077088083c14961cf2f1e4506995Affected 610bfc6bc99bc83680d190ebc69359a05fc7f605 to before e91d2cc7441d89a45bad73ad9789159c7441cb80Affected 610bfc6bc99bc83680d190ebc69359a05fc7f605 to before 2dffc8c44b6e3347b3719c6419c07b4a18fea895Affected 610bfc6bc99bc83680d190ebc69359a05fc7f605 to before ad46c907d7d9975a285c1e89a4adde652eaa93f5Affected
LinuxLinux	3.13Affected before 3.13Not affected 5.10.270 through 5.10.Not affected 5.15.221 through 5.15.Not affected 6.1.188 through 6.1.Not affected 6.6.157 through 6.6.Not affected 6.12.110 through 6.12.Not affected 6.18.51 through 6.18.Not affected 7.2.5 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

610bfc6bc99bc83680d190ebc69359a05fc7f605 to before 63d86250fa7cbe22451369bd1c0881dfc8190958Affected
610bfc6bc99bc83680d190ebc69359a05fc7f605 to before f830c2dfc1431764db9256b3d5db1695fc9a7f56Affected
610bfc6bc99bc83680d190ebc69359a05fc7f605 to before f4b4ae763b5d59319fad62a00c76676758e7dafaAffected
610bfc6bc99bc83680d190ebc69359a05fc7f605 to before 6df64825f8b199921120c685af2abca14b077331Affected
610bfc6bc99bc83680d190ebc69359a05fc7f605 to before a2c272da99c2077088083c14961cf2f1e4506995Affected
610bfc6bc99bc83680d190ebc69359a05fc7f605 to before e91d2cc7441d89a45bad73ad9789159c7441cb80Affected
610bfc6bc99bc83680d190ebc69359a05fc7f605 to before 2dffc8c44b6e3347b3719c6419c07b4a18fea895Affected
610bfc6bc99bc83680d190ebc69359a05fc7f605 to before ad46c907d7d9975a285c1e89a4adde652eaa93f5Affected

LinuxLinux

3.13Affected
before 3.13Not affected
5.10.270 through 5.10.*Not affected
5.15.221 through 5.15.*Not affected
6.1.188 through 6.1.*Not affected
6.6.157 through 6.6.*Not affected
6.12.110 through 6.12.*Not affected
6.18.51 through 6.18.*Not affected
7.2.5 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.