CVE-2026-52914

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-52914", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-06-09T07:44:35.367Z", "datePublished": "2026-06-24T07:14:11.906Z", "dateUpdated": "2026-10-19T19:36:59.956Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:31:36.920Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbatman-adv: fix fragment reassembly length accounting\n\nbatman-adv keeps a running payload length for queued fragments and uses it\nto validate a fragment chain before reassembly.\n\nThat accounting currently allows the accumulated fragment length to be\ntruncated during updates. As a result, malformed fragment chains can\nbypass the intended validation and drive reassembly with inconsistent\nlength state, leading to a local denial of service.\n\nFix the accounting by storing the accumulated length in a length-typed\nfield and rejecting update overflows before the existing validation logic\nruns.\n\nThe fix was verified against the original reproducer and against valid\nfragment reassembly paths."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL"}, "scenarios": [{"lang": "en", "value": "AV:N - The vulnerable path is reached by received ETH_P_BATMAN BATADV_UNICAST_FRAG network frames through batadv_batman_skb_recv(). A remote BATMAN-adv mesh peer can deliver crafted fragments to the target node without using a local syscall or device file.\nAC:L - The attacker controls the fragment sequence number, fragment number, total_size field, and payload lengths needed to trigger the wrapped accounting. In a reasonable high-MTU BATMAN-adv deployment, no race or victim-specific state beyond an active mesh interface is required.\nPR:N - The receive path performs packet-format, destination-MAC, mesh-state, and originator lookups, but no authentication or privilege check on the sender. An attacker sending accepted BATMAN-adv frames needs no privileges on the target.\nUI:N - Exploitation is triggered solely by delivery of crafted BATMAN-adv fragments to an active interface. No victim user action is required.\nS:U - The vulnerability corrupts or crashes the kernel handling the same BATMAN-adv/networking security authority. It does not cross a separate boundary such as guest-to-host or IOMMU isolation.\nC:H - The truncated length state can drive reassembly with inconsistent sizing and attacker-controlled fragment data, creating plausible kernel memory corruption. Under the overestimate rule, such corruption can be leveraged for kernel memory disclosure.\nI:H - The reassembly path can size the output skb from the wrapped total while copying more attacker-controlled fragment data than accounted. This is defensibly an out-of-bounds write/kernel memory corruption condition.\nA:H - At minimum, the malformed chain can hit skb tail overrun BUG/panic behavior or otherwise corrupt kernel memory. That gives a reliable kernel crash/denial of service."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/batman-adv/fragmentation.c", "net/batman-adv/types.h"], "versions": [{"version": "610bfc6bc99bc83680d190ebc69359a05fc7f605", "lessThan": "e4f3f6b818aa6a678bc54a2d4e0bece2303c6a64", "status": "affected", "versionType": "git"}, {"version": "610bfc6bc99bc83680d190ebc69359a05fc7f605", "lessThan": "37be61825b15534a16ff9cfc9546de155b6df982", "status": "affected", "versionType": "git"}, {"version": "610bfc6bc99bc83680d190ebc69359a05fc7f605", "lessThan": "975563c5de1123dde1ec7946bf5556d20c89d74e", "status": "affected", "versionType": "git"}, {"version": "610bfc6bc99bc83680d190ebc69359a05fc7f605", "lessThan": "f653b040dad1af70fa5cd4fe085e4758925480c9", "status": "affected", "versionType": "git"}, {"version": "610bfc6bc99bc83680d190ebc69359a05fc7f605", "lessThan": "e910dbf509125fe51ad68e4fa74dc8ab0a8e787a", "status": "affected", "versionType": "git"}, {"version": "610bfc6bc99bc83680d190ebc69359a05fc7f605", "lessThan": "3eb8bcb823391bd58997831b3c9c152a4ba8e255", "status": "affected", "versionType": "git"}, {"version": "610bfc6bc99bc83680d190ebc69359a05fc7f605", "lessThan": "fdb2c96efb2baeb3725e9ce3ede8f1e36f5490f0", "status": "affected", "versionType": "git"}, {"version": "610bfc6bc99bc83680d190ebc69359a05fc7f605", "lessThan": "9cd3f16c320bfdadd4509358122368deb56a5741", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/batman-adv/fragmentation.c", "net/batman-adv/types.h"], "versions": [{"version": "3.13", "status": "affected"}, {"version": "0", "lessThan": "3.13", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.258", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.209", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.175", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.142", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.92", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.34", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0.11", "lessThanOrEqual": "7.0.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.13", "versionEndExcluding": "5.10.258"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.13", "versionEndExcluding": "5.15.209"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.13", "versionEndExcluding": "6.1.175"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.13", "versionEndExcluding": "6.6.142"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.13", "versionEndExcluding": "6.12.92"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.13", "versionEndExcluding": "6.18.34"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.13", "versionEndExcluding": "7.0.11"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.13", "versionEndExcluding": "7.1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/e4f3f6b818aa6a678bc54a2d4e0bece2303c6a64"}, {"url": "https://git.kernel.org/stable/c/37be61825b15534a16ff9cfc9546de155b6df982"}, {"url": "https://git.kernel.org/stable/c/975563c5de1123dde1ec7946bf5556d20c89d74e"}, {"url": "https://git.kernel.org/stable/c/f653b040dad1af70fa5cd4fe085e4758925480c9"}, {"url": "https://git.kernel.org/stable/c/e910dbf509125fe51ad68e4fa74dc8ab0a8e787a"}, {"url": "https://git.kernel.org/stable/c/3eb8bcb823391bd58997831b3c9c152a4ba8e255"}, {"url": "https://git.kernel.org/stable/c/fdb2c96efb2baeb3725e9ce3ede8f1e36f5490f0"}, {"url": "https://git.kernel.org/stable/c/9cd3f16c320bfdadd4509358122368deb56a5741"}], "title": "batman-adv: fix fragment reassembly length accounting", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-52914", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T15:22:33.098650Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-190", "description": "CWE-190 Integer Overflow or Wraparound"}]}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-19T19:36:59.956Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-52914", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T15:22:33.098650Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-190", "description": "CWE-190 Integer Overflow or Wraparound"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T15:22:33.732Z"}}], "cna": {"title": "batman-adv: fix fragment reassembly length accounting", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:N - The vulnerable path is reached by received ETH_P_BATMAN BATADV_UNICAST_FRAG network frames through batadv_batman_skb_recv(). A remote BATMAN-adv mesh peer can deliver crafted fragments to the target node without using a local syscall or device file.\nAC:L - The attacker controls the fragment sequence number, fragment number, total_size field, and payload lengths needed to trigger the wrapped accounting. In a reasonable high-MTU BATMAN-adv deployment, no race or victim-specific state beyond an active mesh interface is required.\nPR:N - The receive path performs packet-format, destination-MAC, mesh-state, and originator lookups, but no authentication or privilege check on the sender. An attacker sending accepted BATMAN-adv frames needs no privileges on the target.\nUI:N - Exploitation is triggered solely by delivery of crafted BATMAN-adv fragments to an active interface. No victim user action is required.\nS:U - The vulnerability corrupts or crashes the kernel handling the same BATMAN-adv/networking security authority. It does not cross a separate boundary such as guest-to-host or IOMMU isolation.\nC:H - The truncated length state can drive reassembly with inconsistent sizing and attacker-controlled fragment data, creating plausible kernel memory corruption. Under the overestimate rule, such corruption can be leveraged for kernel memory disclosure.\nI:H - The reassembly path can size the output skb from the wrapped total while copying more attacker-controlled fragment data than accounted. This is defensibly an out-of-bounds write/kernel memory corruption condition.\nA:H - At minimum, the malformed chain can hit skb tail overrun BUG/panic behavior or otherwise corrupt kernel memory. That gives a reliable kernel crash/denial of service."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "610bfc6bc99bc83680d190ebc69359a05fc7f605", "lessThan": "e4f3f6b818aa6a678bc54a2d4e0bece2303c6a64", "versionType": "git"}, {"status": "affected", "version": "610bfc6bc99bc83680d190ebc69359a05fc7f605", "lessThan": "37be61825b15534a16ff9cfc9546de155b6df982", "versionType": "git"}, {"status": "affected", "version": "610bfc6bc99bc83680d190ebc69359a05fc7f605", "lessThan": "975563c5de1123dde1ec7946bf5556d20c89d74e", "versionType": "git"}, {"status": "affected", "version": "610bfc6bc99bc83680d190ebc69359a05fc7f605", "lessThan": "f653b040dad1af70fa5cd4fe085e4758925480c9", "versionType": "git"}, {"status": "affected", "version": "610bfc6bc99bc83680d190ebc69359a05fc7f605", "lessThan": "e910dbf509125fe51ad68e4fa74dc8ab0a8e787a", "versionType": "git"}, {"status": "affected", "version": "610bfc6bc99bc83680d190ebc69359a05fc7f605", "lessThan": "3eb8bcb823391bd58997831b3c9c152a4ba8e255", "versionType": "git"}, {"status": "affected", "version": "610bfc6bc99bc83680d190ebc69359a05fc7f605", "lessThan": "fdb2c96efb2baeb3725e9ce3ede8f1e36f5490f0", "versionType": "git"}, {"status": "affected", "version": "610bfc6bc99bc83680d190ebc69359a05fc7f605", "lessThan": "9cd3f16c320bfdadd4509358122368deb56a5741", "versionType": "git"}], "programFiles": ["net/batman-adv/fragmentation.c", "net/batman-adv/types.h"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "3.13"}, {"status": "unaffected", "version": "0", "lessThan": "3.13", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.258", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.209", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.175", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.142", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.92", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.34", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.0.11", "versionType": "semver", "lessThanOrEqual": "7.0.*"}, {"status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["net/batman-adv/fragmentation.c", "net/batman-adv/types.h"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/e4f3f6b818aa6a678bc54a2d4e0bece2303c6a64"}, {"url": "https://git.kernel.org/stable/c/37be61825b15534a16ff9cfc9546de155b6df982"}, {"url": "https://git.kernel.org/stable/c/975563c5de1123dde1ec7946bf5556d20c89d74e"}, {"url": "https://git.kernel.org/stable/c/f653b040dad1af70fa5cd4fe085e4758925480c9"}, {"url": "https://git.kernel.org/stable/c/e910dbf509125fe51ad68e4fa74dc8ab0a8e787a"}, {"url": "https://git.kernel.org/stable/c/3eb8bcb823391bd58997831b3c9c152a4ba8e255"}, {"url": "https://git.kernel.org/stable/c/fdb2c96efb2baeb3725e9ce3ede8f1e36f5490f0"}, {"url": "https://git.kernel.org/stable/c/9cd3f16c320bfdadd4509358122368deb56a5741"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbatman-adv: fix fragment reassembly length accounting\n\nbatman-adv keeps a running payload length for queued fragments and uses it\nto validate a fragment chain before reassembly.\n\nThat accounting currently allows the accumulated fragment length to be\ntruncated during updates. As a result, malformed fragment chains can\nbypass the intended validation and drive reassembly with inconsistent\nlength state, leading to a local denial of service.\n\nFix the accounting by storing the accumulated length in a length-typed\nfield and rejecting update overflows before the existing validation logic\nruns.\n\nThe fix was verified against the original reproducer and against valid\nfragment reassembly paths."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.258", "versionStartIncluding": "3.13"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.209", "versionStartIncluding": "3.13"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.175", "versionStartIncluding": "3.13"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.142", "versionStartIncluding": "3.13"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.92", "versionStartIncluding": "3.13"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.34", "versionStartIncluding": "3.13"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.0.11", "versionStartIncluding": "3.13"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.1", "versionStartIncluding": "3.13"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:31:36.920Z"}}}, "cveMetadata": {"cveId": "CVE-2026-52914", "state": "PUBLISHED", "dateUpdated": "2026-10-19T19:36:59.956Z", "dateReserved": "2026-06-09T07:44:35.367Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-06-24T07:14:11.906Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/batman-adv/fragmentation.c", "net/batman-adv/types.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "e4f3f6b818aa6a678bc54a2d4e0bece2303c6a64", "status": "affected", "version": "610bfc6bc99bc83680d190ebc69359a05fc7f605", "versionType": "git"}, {"lessThan": "37be61825b15534a16ff9cfc9546de155b6df982", "status": "affected", "version": "610bfc6bc99bc83680d190ebc69359a05fc7f605", "versionType": "git"}, {"lessThan": "975563c5de1123dde1ec7946bf5556d20c89d74e", "status": "affected", "version": "610bfc6bc99bc83680d190ebc69359a05fc7f605", "versionType": "git"}, {"lessThan": "f653b040dad1af70fa5cd4fe085e4758925480c9", "status": "affected", "version": "610bfc6bc99bc83680d190ebc69359a05fc7f605", "versionType": "git"}, {"lessThan": "e910dbf509125fe51ad68e4fa74dc8ab0a8e787a", "status": "affected", "version": "610bfc6bc99bc83680d190ebc69359a05fc7f605", "versionType": "git"}, {"lessThan": "3eb8bcb823391bd58997831b3c9c152a4ba8e255", "status": "affected", "version": "610bfc6bc99bc83680d190ebc69359a05fc7f605", "versionType": "git"}, {"lessThan": "fdb2c96efb2baeb3725e9ce3ede8f1e36f5490f0", "status": "affected", "version": "610bfc6bc99bc83680d190ebc69359a05fc7f605", "versionType": "git"}, {"lessThan": "9cd3f16c320bfdadd4509358122368deb56a5741", "status": "affected", "version": "610bfc6bc99bc83680d190ebc69359a05fc7f605", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/batman-adv/fragmentation.c", "net/batman-adv/types.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "3.13"}, {"lessThan": "3.13", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.258", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.209", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.175", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.142", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.92", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.34", "versionType": "semver"}, {"lessThanOrEqual": "7.0.*", "status": "unaffected", "version": "7.0.11", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "5719375F-EF0E-4109-B597-92834B5F4367", "versionEndExcluding": "5.10.258", "versionStartIncluding": "3.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "919C10A9-7951-4A74-BADD-C135A0A8D8B4", "versionEndExcluding": "5.15.209", "versionStartIncluding": "5.11", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "92385813-D91D-480D-83A1-F423D2CBB2BA", "versionEndExcluding": "6.1.175", "versionStartIncluding": "5.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "FBFF77B0-526A-4AF1-84D0-ED7187624A67", "versionEndExcluding": "6.6.142", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "9CB90BD9-95B7-4D7F-9F17-4ECE6CFB66C9", "versionEndExcluding": "6.12.92", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "A4B1EF6D-18D7-4838-BC37-7499D5DCC3C0", "versionEndExcluding": "6.18.34", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "0520D091-FC52-4A50-AF07-70AE7D08B750", "versionEndExcluding": "7.0.11", "versionStartIncluding": "6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*", "matchCriteriaId": "B1EF7059-E670-45F4-B422-54C40FA86390", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*", "matchCriteriaId": "0D38F0BF-A728-4133-A358-D44A2F7EE6D6", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*", "matchCriteriaId": "EC732D08-5F7B-46D9-B154-E60C7F4F0A97", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:*", "matchCriteriaId": "E5910A9D-F60A-409A-B486-FE66BFEBA9B9", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbatman-adv: fix fragment reassembly length accounting\n\nbatman-adv keeps a running payload length for queued fragments and uses it\nto validate a fragment chain before reassembly.\n\nThat accounting currently allows the accumulated fragment length to be\ntruncated during updates. As a result, malformed fragment chains can\nbypass the intended validation and drive reassembly with inconsistent\nlength state, leading to a local denial of service.\n\nFix the accounting by storing the accumulated length in a length-typed\nfield and rejecting update overflows before the existing validation logic\nruns.\n\nThe fix was verified against the original reproducer and against valid\nfragment reassembly paths."}], "id": "CVE-2026-52914", "lastModified": "2026-10-19T20:18:45.930", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-52914", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-16T15:22:33.098650Z", "version": "2.0.3"}}]}, "published": "2026-06-24T08:16:21.213", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/37be61825b15534a16ff9cfc9546de155b6df982"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/3eb8bcb823391bd58997831b3c9c152a4ba8e255"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/975563c5de1123dde1ec7946bf5556d20c89d74e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/9cd3f16c320bfdadd4509358122368deb56a5741"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/e4f3f6b818aa6a678bc54a2d4e0bece2303c6a64"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/e910dbf509125fe51ad68e4fa74dc8ab0a8e787a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/f653b040dad1af70fa5cd4fe085e4758925480c9"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/fdb2c96efb2baeb3725e9ce3ede8f1e36f5490f0"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-787"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-190"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"bugzilla": {"description": "kernel: batman-adv: fix fragment reassembly length accounting", "id": "2492100", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492100"}, "csaw": false, "cwe": "CWE-130", "details": ["A flaw was found in the Linux kernel's batman-adv component. This vulnerability allows a local attacker to cause a denial of service (DoS) by sending malformed fragment chains. The flaw is due to incorrect accounting of fragment reassembly length, which can be truncated during updates, bypassing validation and leading to inconsistent length states during reassembly."], "name": "CVE-2026-52914", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-06-24T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-52914\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-52914\nhttps://lore.kernel.org/linux-cve-announce/2026062428-CVE-2026-52914-f89a@gregkh/T"]}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[610bfc6bc99bc83680d190ebc69359a05fc7f605,e4f3f6b818aa6a678bc54a2d4e0bece2303c6a64)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[610bfc6bc99bc83680d190ebc69359a05fc7f605,37be61825b15534a16ff9cfc9546de155b6df982)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[610bfc6bc99bc83680d190ebc69359a05fc7f605,975563c5de1123dde1ec7946bf5556d20c89d74e)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[610bfc6bc99bc83680d190ebc69359a05fc7f605,f653b040dad1af70fa5cd4fe085e4758925480c9)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[610bfc6bc99bc83680d190ebc69359a05fc7f605,e910dbf509125fe51ad68e4fa74dc8ab0a8e787a)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[610bfc6bc99bc83680d190ebc69359a05fc7f605,3eb8bcb823391bd58997831b3c9c152a4ba8e255)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[610bfc6bc99bc83680d190ebc69359a05fc7f605,fdb2c96efb2baeb3725e9ce3ede8f1e36f5490f0)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[610bfc6bc99bc83680d190ebc69359a05fc7f605,9cd3f16c320bfdadd4509358122368deb56a5741)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "3.13"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,3.13)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.10.258,5.11.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.15.209,5.16.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.1.175,6.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.142,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.92,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.0.11,7.1.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-06-24T10:45:03.081964+00:00", "updated": "2026-10-23T00:45:13.624458+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}