CVE-2026-52916

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-52916", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-06-09T07:44:35.367Z", "datePublished": "2026-06-24T07:14:13.221Z", "dateUpdated": "2026-06-24T07:14:13.221Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-06-24T07:14:13.221Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbatman-adv: frag: disallow unicast fragment in fragment\n\nbatadv_frag_skb_buffer() is called by batadv_batman_skb_recv() when a\nBATADV_UNICAST_FRAG packet is received. Once all fragments are collected\nand the packet is reassembled, batadv_recv_frag_packet() calls\nbatadv_batman_skb_recv() again to process the defragmented payload.\n\nA malicious sender can craft a BATADV_UNICAST_FRAG packet whose reassembled\npayload is itself a BATADV_UNICAST_FRAG packet (matryoshka-style nesting).\nEach nesting level recurses through batadv_batman_skb_recv() without bound,\ngrowing the kernel stack until it is exhausted.\n\nSince refragmentation or fragments in fragments are not actually allowed,\ndiscard all packets which are still BATADV_UNICAST_FRAG packets after the\ndefragmentation process."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/batman-adv/fragmentation.c"], "versions": [{"version": "610bfc6bc99bc83680d190ebc69359a05fc7f605", "lessThan": "0c208fa3859e3a33a1c38bebc41d021166e94ac8", "status": "affected", "versionType": "git"}, {"version": "610bfc6bc99bc83680d190ebc69359a05fc7f605", "lessThan": "bcda4814dc6524283c0b958882cb963d75fe411d", "status": "affected", "versionType": "git"}, {"version": "610bfc6bc99bc83680d190ebc69359a05fc7f605", "lessThan": "aea54d0bbe156d5ab7d00d68f66149ff41f4612a", "status": "affected", "versionType": "git"}, {"version": "610bfc6bc99bc83680d190ebc69359a05fc7f605", "lessThan": "b54e459cf86943583c1aa2ee3081874e7ab1f5f3", "status": "affected", "versionType": "git"}, {"version": "610bfc6bc99bc83680d190ebc69359a05fc7f605", "lessThan": "5418be6c2e117bf8a316582795a8e3ff90f45e5d", "status": "affected", "versionType": "git"}, {"version": "610bfc6bc99bc83680d190ebc69359a05fc7f605", "lessThan": "5895ad21c7059a652da83fb817510f7a1e962abf", "status": "affected", "versionType": "git"}, {"version": "610bfc6bc99bc83680d190ebc69359a05fc7f605", "lessThan": "7138c35c9ad39a2fca6264af6b87466471f04ffc", "status": "affected", "versionType": "git"}, {"version": "610bfc6bc99bc83680d190ebc69359a05fc7f605", "lessThan": "bc62216dc8e221e3781afa14430f45208bfa9af9", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/batman-adv/fragmentation.c"], "versions": [{"version": "3.13", "status": "affected"}, {"version": "0", "lessThan": "3.13", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.258", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.209", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.175", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.142", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.92", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.34", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0.11", "lessThanOrEqual": "7.0.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.13", "versionEndExcluding": "5.10.258"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.13", "versionEndExcluding": "5.15.209"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.13", "versionEndExcluding": "6.1.175"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.13", "versionEndExcluding": "6.6.142"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.13", "versionEndExcluding": "6.12.92"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.13", "versionEndExcluding": "6.18.34"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.13", "versionEndExcluding": "7.0.11"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.13", "versionEndExcluding": "7.1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/0c208fa3859e3a33a1c38bebc41d021166e94ac8"}, {"url": "https://git.kernel.org/stable/c/bcda4814dc6524283c0b958882cb963d75fe411d"}, {"url": "https://git.kernel.org/stable/c/aea54d0bbe156d5ab7d00d68f66149ff41f4612a"}, {"url": "https://git.kernel.org/stable/c/b54e459cf86943583c1aa2ee3081874e7ab1f5f3"}, {"url": "https://git.kernel.org/stable/c/5418be6c2e117bf8a316582795a8e3ff90f45e5d"}, {"url": "https://git.kernel.org/stable/c/5895ad21c7059a652da83fb817510f7a1e962abf"}, {"url": "https://git.kernel.org/stable/c/7138c35c9ad39a2fca6264af6b87466471f04ffc"}, {"url": "https://git.kernel.org/stable/c/bc62216dc8e221e3781afa14430f45208bfa9af9"}], "title": "batman-adv: frag: disallow unicast fragment in fragment", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/batman-adv/fragmentation.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "0c208fa3859e3a33a1c38bebc41d021166e94ac8", "status": "affected", "version": "610bfc6bc99bc83680d190ebc69359a05fc7f605", "versionType": "git"}, {"lessThan": "bcda4814dc6524283c0b958882cb963d75fe411d", "status": "affected", "version": "610bfc6bc99bc83680d190ebc69359a05fc7f605", "versionType": "git"}, {"lessThan": "aea54d0bbe156d5ab7d00d68f66149ff41f4612a", "status": "affected", "version": "610bfc6bc99bc83680d190ebc69359a05fc7f605", "versionType": "git"}, {"lessThan": "b54e459cf86943583c1aa2ee3081874e7ab1f5f3", "status": "affected", "version": "610bfc6bc99bc83680d190ebc69359a05fc7f605", "versionType": "git"}, {"lessThan": "5418be6c2e117bf8a316582795a8e3ff90f45e5d", "status": "affected", "version": "610bfc6bc99bc83680d190ebc69359a05fc7f605", "versionType": "git"}, {"lessThan": "5895ad21c7059a652da83fb817510f7a1e962abf", "status": "affected", "version": "610bfc6bc99bc83680d190ebc69359a05fc7f605", "versionType": "git"}, {"lessThan": "7138c35c9ad39a2fca6264af6b87466471f04ffc", "status": "affected", "version": "610bfc6bc99bc83680d190ebc69359a05fc7f605", "versionType": "git"}, {"lessThan": "bc62216dc8e221e3781afa14430f45208bfa9af9", "status": "affected", "version": "610bfc6bc99bc83680d190ebc69359a05fc7f605", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/batman-adv/fragmentation.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "3.13"}, {"lessThan": "3.13", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.258", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.209", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.175", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.142", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.92", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.34", "versionType": "semver"}, {"lessThanOrEqual": "7.0.*", "status": "unaffected", "version": "7.0.11", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "5719375F-EF0E-4109-B597-92834B5F4367", "versionEndExcluding": "5.10.258", "versionStartIncluding": "3.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "919C10A9-7951-4A74-BADD-C135A0A8D8B4", "versionEndExcluding": "5.15.209", "versionStartIncluding": "5.11", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "92385813-D91D-480D-83A1-F423D2CBB2BA", "versionEndExcluding": "6.1.175", "versionStartIncluding": "5.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "FBFF77B0-526A-4AF1-84D0-ED7187624A67", "versionEndExcluding": "6.6.142", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "9CB90BD9-95B7-4D7F-9F17-4ECE6CFB66C9", "versionEndExcluding": "6.12.92", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "A4B1EF6D-18D7-4838-BC37-7499D5DCC3C0", "versionEndExcluding": "6.18.34", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "0520D091-FC52-4A50-AF07-70AE7D08B750", "versionEndExcluding": "7.0.11", "versionStartIncluding": "6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*", "matchCriteriaId": "B1EF7059-E670-45F4-B422-54C40FA86390", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*", "matchCriteriaId": "0D38F0BF-A728-4133-A358-D44A2F7EE6D6", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*", "matchCriteriaId": "EC732D08-5F7B-46D9-B154-E60C7F4F0A97", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:*", "matchCriteriaId": "E5910A9D-F60A-409A-B486-FE66BFEBA9B9", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbatman-adv: frag: disallow unicast fragment in fragment\n\nbatadv_frag_skb_buffer() is called by batadv_batman_skb_recv() when a\nBATADV_UNICAST_FRAG packet is received. Once all fragments are collected\nand the packet is reassembled, batadv_recv_frag_packet() calls\nbatadv_batman_skb_recv() again to process the defragmented payload.\n\nA malicious sender can craft a BATADV_UNICAST_FRAG packet whose reassembled\npayload is itself a BATADV_UNICAST_FRAG packet (matryoshka-style nesting).\nEach nesting level recurses through batadv_batman_skb_recv() without bound,\ngrowing the kernel stack until it is exhausted.\n\nSince refragmentation or fragments in fragments are not actually allowed,\ndiscard all packets which are still BATADV_UNICAST_FRAG packets after the\ndefragmentation process."}], "id": "CVE-2026-52916", "lastModified": "2026-07-08T15:12:46.487", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2026-06-24T08:16:21.463", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/0c208fa3859e3a33a1c38bebc41d021166e94ac8"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/5418be6c2e117bf8a316582795a8e3ff90f45e5d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/5895ad21c7059a652da83fb817510f7a1e962abf"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/7138c35c9ad39a2fca6264af6b87466471f04ffc"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/aea54d0bbe156d5ab7d00d68f66149ff41f4612a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/b54e459cf86943583c1aa2ee3081874e7ab1f5f3"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/bc62216dc8e221e3781afa14430f45208bfa9af9"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/bcda4814dc6524283c0b958882cb963d75fe411d"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: batman-adv: frag: disallow unicast fragment in fragment", "id": "2492113", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492113"}, "csaw": false, "cwe": "CWE-770", "details": ["A flaw was found in the Linux kernel's batman-adv module. A remote attacker can exploit this vulnerability by sending specially crafted BATADV_UNICAST_FRAG packets, which are designed to contain other fragmented packets. This 'fragments in fragments' scenario causes the kernel to recursively process the packets without bound, leading to kernel stack exhaustion and ultimately a Denial of Service (DoS) for the affected system."], "name": "CVE-2026-52916", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-06-24T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-52916\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-52916\nhttps://lore.kernel.org/linux-cve-announce/2026062429-CVE-2026-52916-3619@gregkh/T"]}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[610bfc6bc99bc83680d190ebc69359a05fc7f605,0c208fa3859e3a33a1c38bebc41d021166e94ac8)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[610bfc6bc99bc83680d190ebc69359a05fc7f605,5418be6c2e117bf8a316582795a8e3ff90f45e5d)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[610bfc6bc99bc83680d190ebc69359a05fc7f605,5895ad21c7059a652da83fb817510f7a1e962abf)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[610bfc6bc99bc83680d190ebc69359a05fc7f605,7138c35c9ad39a2fca6264af6b87466471f04ffc)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[610bfc6bc99bc83680d190ebc69359a05fc7f605,aea54d0bbe156d5ab7d00d68f66149ff41f4612a)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[610bfc6bc99bc83680d190ebc69359a05fc7f605,b54e459cf86943583c1aa2ee3081874e7ab1f5f3)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[610bfc6bc99bc83680d190ebc69359a05fc7f605,bc62216dc8e221e3781afa14430f45208bfa9af9)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[610bfc6bc99bc83680d190ebc69359a05fc7f605,bcda4814dc6524283c0b958882cb963d75fe411d)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "3.13"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,3.13)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.10.258,5.11.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.15.209,5.16.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.1.175,6.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.142,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.92,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.34,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.0.11,7.1.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-06-24T10:15:05.096130+00:00", "updated": "2026-08-13T22:15:03.349381+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}