CVE-2026-52931

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-52931", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-06-09T07:44:35.369Z", "datePublished": "2026-06-24T07:14:23.349Z", "dateUpdated": "2026-10-19T19:47:08.135Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:31:48.973Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbatman-adv: tp_meter: avoid use of uninit sender vars\n\nbatadv_tp_recv_ack() and batadv_tp_stop() are only valid for tp_vars in the\nBATADV_TP_SENDER role. When called with a BATADV_TP_RECEIVER role, it\nproceeds to read sender-only members that were never initialized, leading\nto undefined behavior.\n\nThis can be triggered when a node that is currently acting as a receiver in\nan ongoing tp_meter session receives a malicious ACK packet.\n\nGuard against this by checking tp_vars->role immediately after the\nlookup and bailing out if it is not BATADV_TP_SENDER, before any of\nthose members are accessed."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL"}, "scenarios": [{"lang": "en", "value": "AV:N - The vulnerable code is reached by crafted BATMAN-adv ICMP TP packets received on an active batman-adv mesh interface and can be delivered by a remote mesh peer over the network. It is not a local-only netlink path and does not require physical access.\nAC:L - No race or victim timing is required; the attacker controls the TP session creation packet and the follow-up malicious ACK. The requirement that batman-adv is active is an environmental precondition for the affected subsystem.\nPR:N - The packet receive path has no credential or authentication check before `batadv_tp_meter_recv()` and `batadv_tp_recv_ack()`. A malicious peer can create the receiver-side tp_meter session with a TP MSG and then send a matching TP ACK.\nUI:N - Exploitation is driven entirely by attacker-sent network packets. No victim user action is required once the target batman-adv interface is active.\nS:U - The impact is within the vulnerable kernel instance and its batman-adv networking context. This is not a VM escape, IOMMU bypass, or cross-authority boundary violation.\nC:H - The ACK path can operate on uninitialized sender-only state, including waitqueue/list/lock and counter fields, creating kernel memory corruption potential. Under conservative scoring, successful exploitation of that corruption can expose arbitrary kernel memory.\nI:H - The same uninitialized sender state can drive writes through corrupted kernel synchronization/list structures and sender counters. With heap grooming, this is defensible as a kernel memory corruption primitive capable of arbitrary modification or code execution.\nA:H - At minimum, forged ACKs can dereference or manipulate uninitialized lock, list, timer, and waitqueue state, leading to kernel oops, panic, hang, or sustained denial of service. The trigger can be repeated by sending additional crafted packets."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/batman-adv/tp_meter.c"], "versions": [{"version": "33a3bb4a3345bb511f9c69c913da95d4693e2a4e", "lessThan": "0e388af04b3958b178a1b979527f93eb46ea1fee", "status": "affected", "versionType": "git"}, {"version": "33a3bb4a3345bb511f9c69c913da95d4693e2a4e", "lessThan": "1a21c055f66e78973712a4a1be2a554f1ee2e4f4", "status": "affected", "versionType": "git"}, {"version": "33a3bb4a3345bb511f9c69c913da95d4693e2a4e", "lessThan": "9884c9c02d3c90e9215db3c5128f59045d20ae91", "status": "affected", "versionType": "git"}, {"version": "33a3bb4a3345bb511f9c69c913da95d4693e2a4e", "lessThan": "53f931e0146ae5bdab4cba302646827d06b3794b", "status": "affected", "versionType": "git"}, {"version": "33a3bb4a3345bb511f9c69c913da95d4693e2a4e", "lessThan": "ecdaa3e4d91040206afe21bc8a0d1198a0971ff3", "status": "affected", "versionType": "git"}, {"version": "33a3bb4a3345bb511f9c69c913da95d4693e2a4e", "lessThan": "dc2ae5fbd2dadc26735092f140b246841d969a11", "status": "affected", "versionType": "git"}, {"version": "33a3bb4a3345bb511f9c69c913da95d4693e2a4e", "lessThan": "85397e48afe6be83ffca5ad3f4792296bfc81d3d", "status": "affected", "versionType": "git"}, {"version": "33a3bb4a3345bb511f9c69c913da95d4693e2a4e", "lessThan": "6c65cf23d4c6170fcf5714c32aa64689718cb142", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/batman-adv/tp_meter.c"], "versions": [{"version": "4.8", "status": "affected"}, {"version": "0", "lessThan": "4.8", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.258", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.209", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.175", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.142", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.92", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.34", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0.11", "lessThanOrEqual": "7.0.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.8", "versionEndExcluding": "5.10.258"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.8", "versionEndExcluding": "5.15.209"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.8", "versionEndExcluding": "6.1.175"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.8", "versionEndExcluding": "6.6.142"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.8", "versionEndExcluding": "6.12.92"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.8", "versionEndExcluding": "6.18.34"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.8", "versionEndExcluding": "7.0.11"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.8", "versionEndExcluding": "7.1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/0e388af04b3958b178a1b979527f93eb46ea1fee"}, {"url": "https://git.kernel.org/stable/c/1a21c055f66e78973712a4a1be2a554f1ee2e4f4"}, {"url": "https://git.kernel.org/stable/c/9884c9c02d3c90e9215db3c5128f59045d20ae91"}, {"url": "https://git.kernel.org/stable/c/53f931e0146ae5bdab4cba302646827d06b3794b"}, {"url": "https://git.kernel.org/stable/c/ecdaa3e4d91040206afe21bc8a0d1198a0971ff3"}, {"url": "https://git.kernel.org/stable/c/dc2ae5fbd2dadc26735092f140b246841d969a11"}, {"url": "https://git.kernel.org/stable/c/85397e48afe6be83ffca5ad3f4792296bfc81d3d"}, {"url": "https://git.kernel.org/stable/c/6c65cf23d4c6170fcf5714c32aa64689718cb142"}], "title": "batman-adv: tp_meter: avoid use of uninit sender vars", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-52931", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T15:22:56.523989Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-457", "description": "CWE-457 Use of Uninitialized Variable"}]}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-19T19:47:08.135Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-52931", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T15:22:56.523989Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T15:22:57.081Z"}}], "cna": {"title": "batman-adv: tp_meter: avoid use of uninit sender vars", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:N - The vulnerable code is reached by crafted BATMAN-adv ICMP TP packets received on an active batman-adv mesh interface and can be delivered by a remote mesh peer over the network. It is not a local-only netlink path and does not require physical access.\nAC:L - No race or victim timing is required; the attacker controls the TP session creation packet and the follow-up malicious ACK. The requirement that batman-adv is active is an environmental precondition for the affected subsystem.\nPR:N - The packet receive path has no credential or authentication check before `batadv_tp_meter_recv()` and `batadv_tp_recv_ack()`. A malicious peer can create the receiver-side tp_meter session with a TP MSG and then send a matching TP ACK.\nUI:N - Exploitation is driven entirely by attacker-sent network packets. No victim user action is required once the target batman-adv interface is active.\nS:U - The impact is within the vulnerable kernel instance and its batman-adv networking context. This is not a VM escape, IOMMU bypass, or cross-authority boundary violation.\nC:H - The ACK path can operate on uninitialized sender-only state, including waitqueue/list/lock and counter fields, creating kernel memory corruption potential. Under conservative scoring, successful exploitation of that corruption can expose arbitrary kernel memory.\nI:H - The same uninitialized sender state can drive writes through corrupted kernel synchronization/list structures and sender counters. With heap grooming, this is defensible as a kernel memory corruption primitive capable of arbitrary modification or code execution.\nA:H - At minimum, forged ACKs can dereference or manipulate uninitialized lock, list, timer, and waitqueue state, leading to kernel oops, panic, hang, or sustained denial of service. The trigger can be repeated by sending additional crafted packets."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "33a3bb4a3345bb511f9c69c913da95d4693e2a4e", "lessThan": "0e388af04b3958b178a1b979527f93eb46ea1fee", "versionType": "git"}, {"status": "affected", "version": "33a3bb4a3345bb511f9c69c913da95d4693e2a4e", "lessThan": "1a21c055f66e78973712a4a1be2a554f1ee2e4f4", "versionType": "git"}, {"status": "affected", "version": "33a3bb4a3345bb511f9c69c913da95d4693e2a4e", "lessThan": "9884c9c02d3c90e9215db3c5128f59045d20ae91", "versionType": "git"}, {"status": "affected", "version": "33a3bb4a3345bb511f9c69c913da95d4693e2a4e", "lessThan": "53f931e0146ae5bdab4cba302646827d06b3794b", "versionType": "git"}, {"status": "affected", "version": "33a3bb4a3345bb511f9c69c913da95d4693e2a4e", "lessThan": "ecdaa3e4d91040206afe21bc8a0d1198a0971ff3", "versionType": "git"}, {"status": "affected", "version": "33a3bb4a3345bb511f9c69c913da95d4693e2a4e", "lessThan": "dc2ae5fbd2dadc26735092f140b246841d969a11", "versionType": "git"}, {"status": "affected", "version": "33a3bb4a3345bb511f9c69c913da95d4693e2a4e", "lessThan": "85397e48afe6be83ffca5ad3f4792296bfc81d3d", "versionType": "git"}, {"status": "affected", "version": "33a3bb4a3345bb511f9c69c913da95d4693e2a4e", "lessThan": "6c65cf23d4c6170fcf5714c32aa64689718cb142", "versionType": "git"}], "programFiles": ["net/batman-adv/tp_meter.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "4.8"}, {"status": "unaffected", "version": "0", "lessThan": "4.8", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.258", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.209", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.175", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.142", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.92", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.34", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.0.11", "versionType": "semver", "lessThanOrEqual": "7.0.*"}, {"status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["net/batman-adv/tp_meter.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/0e388af04b3958b178a1b979527f93eb46ea1fee"}, {"url": "https://git.kernel.org/stable/c/1a21c055f66e78973712a4a1be2a554f1ee2e4f4"}, {"url": "https://git.kernel.org/stable/c/9884c9c02d3c90e9215db3c5128f59045d20ae91"}, {"url": "https://git.kernel.org/stable/c/53f931e0146ae5bdab4cba302646827d06b3794b"}, {"url": "https://git.kernel.org/stable/c/ecdaa3e4d91040206afe21bc8a0d1198a0971ff3"}, {"url": "https://git.kernel.org/stable/c/dc2ae5fbd2dadc26735092f140b246841d969a11"}, {"url": "https://git.kernel.org/stable/c/85397e48afe6be83ffca5ad3f4792296bfc81d3d"}, {"url": "https://git.kernel.org/stable/c/6c65cf23d4c6170fcf5714c32aa64689718cb142"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbatman-adv: tp_meter: avoid use of uninit sender vars\n\nbatadv_tp_recv_ack() and batadv_tp_stop() are only valid for tp_vars in the\nBATADV_TP_SENDER role. When called with a BATADV_TP_RECEIVER role, it\nproceeds to read sender-only members that were never initialized, leading\nto undefined behavior.\n\nThis can be triggered when a node that is currently acting as a receiver in\nan ongoing tp_meter session receives a malicious ACK packet.\n\nGuard against this by checking tp_vars->role immediately after the\nlookup and bailing out if it is not BATADV_TP_SENDER, before any of\nthose members are accessed."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.258", "versionStartIncluding": "4.8"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.209", "versionStartIncluding": "4.8"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.175", "versionStartIncluding": "4.8"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.142", "versionStartIncluding": "4.8"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.92", "versionStartIncluding": "4.8"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.34", "versionStartIncluding": "4.8"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.0.11", "versionStartIncluding": "4.8"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.1", "versionStartIncluding": "4.8"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:31:48.973Z"}}}, "cveMetadata": {"cveId": "CVE-2026-52931", "state": "PUBLISHED", "dateUpdated": "2026-10-16T15:31:20.602Z", "dateReserved": "2026-06-09T07:44:35.369Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-06-24T07:14:23.349Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/batman-adv/tp_meter.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "0e388af04b3958b178a1b979527f93eb46ea1fee", "status": "affected", "version": "33a3bb4a3345bb511f9c69c913da95d4693e2a4e", "versionType": "git"}, {"lessThan": "1a21c055f66e78973712a4a1be2a554f1ee2e4f4", "status": "affected", "version": "33a3bb4a3345bb511f9c69c913da95d4693e2a4e", "versionType": "git"}, {"lessThan": "9884c9c02d3c90e9215db3c5128f59045d20ae91", "status": "affected", "version": "33a3bb4a3345bb511f9c69c913da95d4693e2a4e", "versionType": "git"}, {"lessThan": "53f931e0146ae5bdab4cba302646827d06b3794b", "status": "affected", "version": "33a3bb4a3345bb511f9c69c913da95d4693e2a4e", "versionType": "git"}, {"lessThan": "ecdaa3e4d91040206afe21bc8a0d1198a0971ff3", "status": "affected", "version": "33a3bb4a3345bb511f9c69c913da95d4693e2a4e", "versionType": "git"}, {"lessThan": "dc2ae5fbd2dadc26735092f140b246841d969a11", "status": "affected", "version": "33a3bb4a3345bb511f9c69c913da95d4693e2a4e", "versionType": "git"}, {"lessThan": "85397e48afe6be83ffca5ad3f4792296bfc81d3d", "status": "affected", "version": "33a3bb4a3345bb511f9c69c913da95d4693e2a4e", "versionType": "git"}, {"lessThan": "6c65cf23d4c6170fcf5714c32aa64689718cb142", "status": "affected", "version": "33a3bb4a3345bb511f9c69c913da95d4693e2a4e", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/batman-adv/tp_meter.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.8"}, {"lessThan": "4.8", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.258", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.209", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.175", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.142", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.92", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.34", "versionType": "semver"}, {"lessThanOrEqual": "7.0.*", "status": "unaffected", "version": "7.0.11", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "1CA35684-7A23-48C2-8A06-2BD61F906C76", "versionEndExcluding": "5.10.258", "versionStartIncluding": "4.8", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "919C10A9-7951-4A74-BADD-C135A0A8D8B4", "versionEndExcluding": "5.15.209", "versionStartIncluding": "5.11", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "92385813-D91D-480D-83A1-F423D2CBB2BA", "versionEndExcluding": "6.1.175", "versionStartIncluding": "5.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "FBFF77B0-526A-4AF1-84D0-ED7187624A67", "versionEndExcluding": "6.6.142", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "9CB90BD9-95B7-4D7F-9F17-4ECE6CFB66C9", "versionEndExcluding": "6.12.92", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "A4B1EF6D-18D7-4838-BC37-7499D5DCC3C0", "versionEndExcluding": "6.18.34", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "0520D091-FC52-4A50-AF07-70AE7D08B750", "versionEndExcluding": "7.0.11", "versionStartIncluding": "6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*", "matchCriteriaId": "B1EF7059-E670-45F4-B422-54C40FA86390", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*", "matchCriteriaId": "0D38F0BF-A728-4133-A358-D44A2F7EE6D6", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*", "matchCriteriaId": "EC732D08-5F7B-46D9-B154-E60C7F4F0A97", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:*", "matchCriteriaId": "E5910A9D-F60A-409A-B486-FE66BFEBA9B9", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbatman-adv: tp_meter: avoid use of uninit sender vars\n\nbatadv_tp_recv_ack() and batadv_tp_stop() are only valid for tp_vars in the\nBATADV_TP_SENDER role. When called with a BATADV_TP_RECEIVER role, it\nproceeds to read sender-only members that were never initialized, leading\nto undefined behavior.\n\nThis can be triggered when a node that is currently acting as a receiver in\nan ongoing tp_meter session receives a malicious ACK packet.\n\nGuard against this by checking tp_vars->role immediately after the\nlookup and bailing out if it is not BATADV_TP_SENDER, before any of\nthose members are accessed."}], "id": "CVE-2026-52931", "lastModified": "2026-10-19T20:18:47.920", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-52931", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-16T15:22:56.523989Z", "version": "2.0.3"}}]}, "published": "2026-06-24T08:16:23.273", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/0e388af04b3958b178a1b979527f93eb46ea1fee"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/1a21c055f66e78973712a4a1be2a554f1ee2e4f4"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/53f931e0146ae5bdab4cba302646827d06b3794b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/6c65cf23d4c6170fcf5714c32aa64689718cb142"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/85397e48afe6be83ffca5ad3f4792296bfc81d3d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/9884c9c02d3c90e9215db3c5128f59045d20ae91"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/dc2ae5fbd2dadc26735092f140b246841d969a11"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/ecdaa3e4d91040206afe21bc8a0d1198a0971ff3"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-457"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"bugzilla": {"description": "kernel: batman-adv: tp_meter: avoid use of uninit sender vars", "id": "2492118", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492118"}, "csaw": false, "cwe": "CWE-824", "details": ["A flaw was found in the `batman-adv` `tp_meter` module of the Linux kernel. A remote attacker could exploit this vulnerability by sending a specially crafted acknowledgment (ACK) packet to a node configured as a receiver in an ongoing `tp_meter` session. This could lead to the use of uninitialized sender variables, resulting in undefined behavior and potentially a denial of service."], "name": "CVE-2026-52931", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-06-24T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-52931\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-52931\nhttps://lore.kernel.org/linux-cve-announce/2026062432-CVE-2026-52931-f85c@gregkh/T"]}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[33a3bb4a3345bb511f9c69c913da95d4693e2a4e,0e388af04b3958b178a1b979527f93eb46ea1fee)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[33a3bb4a3345bb511f9c69c913da95d4693e2a4e,1a21c055f66e78973712a4a1be2a554f1ee2e4f4)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[33a3bb4a3345bb511f9c69c913da95d4693e2a4e,53f931e0146ae5bdab4cba302646827d06b3794b)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[33a3bb4a3345bb511f9c69c913da95d4693e2a4e,6c65cf23d4c6170fcf5714c32aa64689718cb142)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[33a3bb4a3345bb511f9c69c913da95d4693e2a4e,9884c9c02d3c90e9215db3c5128f59045d20ae91)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[33a3bb4a3345bb511f9c69c913da95d4693e2a4e,ecdaa3e4d91040206afe21bc8a0d1198a0971ff3)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[33a3bb4a3345bb511f9c69c913da95d4693e2a4e,dc2ae5fbd2dadc26735092f140b246841d969a11)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[33a3bb4a3345bb511f9c69c913da95d4693e2a4e,85397e48afe6be83ffca5ad3f4792296bfc81d3d)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[33a3bb4a3345bb511f9c69c913da95d4693e2a4e,6c65cf23d4c6170fcf5714c32aa64689718cb142)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.8"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,4.8)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[5.10.258,5.10.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[5.15.209,5.15.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.1.175,6.1.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.6.142,6.6.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.12.92,6.12.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.18.34,6.18.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.0.11,7.0.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-06-24T12:30:16.069985+00:00", "updated": "2026-10-20T02:15:07.693244+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-457", "CWE-824"]}