CVE-2026-89951

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-89951", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-11T19:38:34.777Z", "datePublished": "2026-09-16T10:32:36.179Z", "dateUpdated": "2026-10-19T08:55:25.323Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T08:55:25.323Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbatman-adv: fix stale receive device on merged fragments\n\nFragment reassembly reuses the skb from the highest-numbered buffered\nfragment as the merged packet. When that fragment was received on a hard\ninterface which is deleted before the chain completes, the merged skb can\nre-enter the receive path with a stale skb->dev and skb_iif.\n\nbatadv_batman_skb_recv() passes such merged packets through the normal\nreceive handlers again. DAT and bridge loop avoidance both derive the ARP\nheader length from skb->dev, so they can dereference the freed net_device\nbefore the packet reaches the local mesh interface.\n\nRefresh the receive device metadata from the current receive device before\nrunning the packet handlers. This keeps internally reinjected merged\nfragments consistent with the normal receive path after hard interface\nteardown."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:A - Merged BATADV_UNICAST_FRAG packets re-enter batadv_batman_skb_recv() after ETH_P_BATMAN receive on a mesh hard interface; an attacker must inject those frames on the same L2 mesh segment (WiFi IBSS/802.11s, Ethernet backbone, or community-mesh overlay), not via arbitrary Internet routing.\nAC:L - The attacker fully controls fragment headers, inner ARP payload, and both send steps (buffer the highest-numbered fragment, then complete the chain on a remaining active hard interface). In-window fragments are not purged on NETDEV_UNREGISTER, so the stale skb->dev UAF needs no uninfluenceable heap layout.\nPR:N - batadv_batman_skb_recv() is an unauthenticated packet_type handler; any adjacent mesh peer can send BATADV_UNICAST_FRAG frames. Originator presence is obtained by sending OGMs or spoofing a MAC learned from the mesh, with no local account or CAP_NET_ADMIN on the victim.\nUI:N - Exploitation requires only attacker-sent mesh fragments; the kernel buffers, merges, and runs DAT ARP parsing in NET_RX_SOFTIRQ without any victim click, mount, or extra administrative action at exploit time.\nS:U - The use-after-free is of a kernel net_device in batman-adv on the victim host and does not cross a VM/host, IOMMU, or sandbox security authority.\nC:H - After hard-interface unregister, batadv_arp_get_type() calls arp_hdr_len(skb->dev) on the merged skb and reads a freed net_device. A kernel-object UAF is high confidentiality impact because reclaim/spray of that object can disclose heap contents.\nI:H - This is a use-after-free of struct net_device on the fragment-merge receive path. Heap spraying the freed object yields attacker-controlled device fields consumed during packet parsing, a memory-corruption primitive suitable for integrity compromise or control-flow hijacking.\nA:H - Dereferencing a freed net_device from NET_RX_SOFTIRQ can oops, panic, or hang when the object is poisoned or unmapped, denying mesh and host availability even without a full exploit."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/batman-adv/main.c"], "versions": [{"version": "610bfc6bc99bc83680d190ebc69359a05fc7f605", "lessThan": "63d86250fa7cbe22451369bd1c0881dfc8190958", "status": "affected", "versionType": "git"}, {"version": "610bfc6bc99bc83680d190ebc69359a05fc7f605", "lessThan": "f830c2dfc1431764db9256b3d5db1695fc9a7f56", "status": "affected", "versionType": "git"}, {"version": "610bfc6bc99bc83680d190ebc69359a05fc7f605", "lessThan": "f4b4ae763b5d59319fad62a00c76676758e7dafa", "status": "affected", "versionType": "git"}, {"version": "610bfc6bc99bc83680d190ebc69359a05fc7f605", "lessThan": "6df64825f8b199921120c685af2abca14b077331", "status": "affected", "versionType": "git"}, {"version": "610bfc6bc99bc83680d190ebc69359a05fc7f605", "lessThan": "a2c272da99c2077088083c14961cf2f1e4506995", "status": "affected", "versionType": "git"}, {"version": "610bfc6bc99bc83680d190ebc69359a05fc7f605", "lessThan": "e91d2cc7441d89a45bad73ad9789159c7441cb80", "status": "affected", "versionType": "git"}, {"version": "610bfc6bc99bc83680d190ebc69359a05fc7f605", "lessThan": "2dffc8c44b6e3347b3719c6419c07b4a18fea895", "status": "affected", "versionType": "git"}, {"version": "610bfc6bc99bc83680d190ebc69359a05fc7f605", "lessThan": "ad46c907d7d9975a285c1e89a4adde652eaa93f5", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/batman-adv/main.c"], "versions": [{"version": "3.13", "status": "affected"}, {"version": "0", "lessThan": "3.13", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.270", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.221", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.188", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.157", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.110", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.51", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.5", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.13", "versionEndExcluding": "5.10.270"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.13", "versionEndExcluding": "5.15.221"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.13", "versionEndExcluding": "6.1.188"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.13", "versionEndExcluding": "6.6.157"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.13", "versionEndExcluding": "6.12.110"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.13", "versionEndExcluding": "6.18.51"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.13", "versionEndExcluding": "7.2.5"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.13", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/63d86250fa7cbe22451369bd1c0881dfc8190958"}, {"url": "https://git.kernel.org/stable/c/f830c2dfc1431764db9256b3d5db1695fc9a7f56"}, {"url": "https://git.kernel.org/stable/c/f4b4ae763b5d59319fad62a00c76676758e7dafa"}, {"url": "https://git.kernel.org/stable/c/6df64825f8b199921120c685af2abca14b077331"}, {"url": "https://git.kernel.org/stable/c/a2c272da99c2077088083c14961cf2f1e4506995"}, {"url": "https://git.kernel.org/stable/c/e91d2cc7441d89a45bad73ad9789159c7441cb80"}, {"url": "https://git.kernel.org/stable/c/2dffc8c44b6e3347b3719c6419c07b4a18fea895"}, {"url": "https://git.kernel.org/stable/c/ad46c907d7d9975a285c1e89a4adde652eaa93f5"}], "title": "batman-adv: fix stale receive device on merged fragments", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/batman-adv/main.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "63d86250fa7cbe22451369bd1c0881dfc8190958", "status": "affected", "version": "610bfc6bc99bc83680d190ebc69359a05fc7f605", "versionType": "git"}, {"lessThan": "f830c2dfc1431764db9256b3d5db1695fc9a7f56", "status": "affected", "version": "610bfc6bc99bc83680d190ebc69359a05fc7f605", "versionType": "git"}, {"lessThan": "f4b4ae763b5d59319fad62a00c76676758e7dafa", "status": "affected", "version": "610bfc6bc99bc83680d190ebc69359a05fc7f605", "versionType": "git"}, {"lessThan": "6df64825f8b199921120c685af2abca14b077331", "status": "affected", "version": "610bfc6bc99bc83680d190ebc69359a05fc7f605", "versionType": "git"}, {"lessThan": "a2c272da99c2077088083c14961cf2f1e4506995", "status": "affected", "version": "610bfc6bc99bc83680d190ebc69359a05fc7f605", "versionType": "git"}, {"lessThan": "e91d2cc7441d89a45bad73ad9789159c7441cb80", "status": "affected", "version": "610bfc6bc99bc83680d190ebc69359a05fc7f605", "versionType": "git"}, {"lessThan": "2dffc8c44b6e3347b3719c6419c07b4a18fea895", "status": "affected", "version": "610bfc6bc99bc83680d190ebc69359a05fc7f605", "versionType": "git"}, {"lessThan": "ad46c907d7d9975a285c1e89a4adde652eaa93f5", "status": "affected", "version": "610bfc6bc99bc83680d190ebc69359a05fc7f605", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/batman-adv/main.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "3.13"}, {"lessThan": "3.13", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.270", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.221", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.188", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.157", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.110", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.51", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.5", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbatman-adv: fix stale receive device on merged fragments\n\nFragment reassembly reuses the skb from the highest-numbered buffered\nfragment as the merged packet. When that fragment was received on a hard\ninterface which is deleted before the chain completes, the merged skb can\nre-enter the receive path with a stale skb->dev and skb_iif.\n\nbatadv_batman_skb_recv() passes such merged packets through the normal\nreceive handlers again. DAT and bridge loop avoidance both derive the ARP\nheader length from skb->dev, so they can dereference the freed net_device\nbefore the packet reaches the local mesh interface.\n\nRefresh the receive device metadata from the current receive device before\nrunning the packet handlers. This keeps internally reinjected merged\nfragments consistent with the normal receive path after hard interface\nteardown."}], "id": "CVE-2026-89951", "lastModified": "2026-10-19T09:18:41.100", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-09-16T11:17:05.267", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/2dffc8c44b6e3347b3719c6419c07b4a18fea895"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/63d86250fa7cbe22451369bd1c0881dfc8190958"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/6df64825f8b199921120c685af2abca14b077331"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/a2c272da99c2077088083c14961cf2f1e4506995"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ad46c907d7d9975a285c1e89a4adde652eaa93f5"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e91d2cc7441d89a45bad73ad9789159c7441cb80"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/f4b4ae763b5d59319fad62a00c76676758e7dafa"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/f830c2dfc1431764db9256b3d5db1695fc9a7f56"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[610bfc6bc99bc83680d190ebc69359a05fc7f605,63d86250fa7cbe22451369bd1c0881dfc8190958)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[610bfc6bc99bc83680d190ebc69359a05fc7f605,f830c2dfc1431764db9256b3d5db1695fc9a7f56)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[610bfc6bc99bc83680d190ebc69359a05fc7f605,f4b4ae763b5d59319fad62a00c76676758e7dafa)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[610bfc6bc99bc83680d190ebc69359a05fc7f605,6df64825f8b199921120c685af2abca14b077331)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[610bfc6bc99bc83680d190ebc69359a05fc7f605,a2c272da99c2077088083c14961cf2f1e4506995)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[610bfc6bc99bc83680d190ebc69359a05fc7f605,e91d2cc7441d89a45bad73ad9789159c7441cb80)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[610bfc6bc99bc83680d190ebc69359a05fc7f605,2dffc8c44b6e3347b3719c6419c07b4a18fea895)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[610bfc6bc99bc83680d190ebc69359a05fc7f605,ad46c907d7d9975a285c1e89a4adde652eaa93f5)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "3.13"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,3.13)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.10.270,5.11.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.15.221,5.16.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.1.188,6.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.157,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.110,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.51,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.5,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3-rc1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-09-17T19:56:53.619611+00:00", "updated": "2026-09-18T07:45:05.212424+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-416"]}