PT-2026-44356 · Linux · Linux

Published 2026-05-28 · Updated 2026-05-28 · CVE-2026-46233

Mitre

In the Linux kernel, the following vulnerability has been resolved:

batman-adv: bla: only purge non-released claims

When batadv bla purge claims() goes through the list of claims, it is only traversing the hash list with an rcu read lock(). Due to a potential parallel batadv claim put(), it can happen that it encounters a claim which was actually in the process of being released+freed by batadv claim release(). In this case, backbone gw is set to NULL before the delayed RCU kfree is started. Calling batadv bla claim get backbone gw() is then no longer allowed because it would cause a NULL-ptr derefence.

To avoid this, only claims with a valid reference counter must be purged. All others are already taken care of.

Related Identifiers

CVE-2026-46233

Affected Products

Linux

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-46233 · Security Note
• https://git.kernel.org/stable/c/cf6b604011591865ae39ac82de8978c1120d17af · Note
• https://git.kernel.org/stable/c/b65365d2b1e6095c538d49baeb140dd1c166c1b3 · Note
• https://git.kernel.org/stable/c/ab3dbd07a809a8eb30c7ddfab9ac886ed30dce8d · Note
• https://git.kernel.org/stable/c/7b8fbcee3184d848b5aee085ca16d0cf05c9b641 · Note
• https://git.kernel.org/stable/c/7b7ebb7222a5524ce58e48cc9c6d688320ea6cfe · Note