PT-2026-51709 · Linux · Linux

Published 2026-06-24 · Updated 2026-06-24 · CVE-2026-52916

NVD

In the Linux kernel, the following vulnerability has been resolved:

batman-adv: frag: disallow unicast fragment in fragment

batadv frag skb buffer() is called by batadv batman skb recv() when a BATADV UNICAST FRAG packet is received. Once all fragments are collected and the packet is reassembled, batadv recv frag packet() calls batadv batman skb recv() again to process the defragmented payload.

A malicious sender can craft a BATADV UNICAST FRAG packet whose reassembled payload is itself a BATADV UNICAST FRAG packet (matryoshka-style nesting). Each nesting level recurses through batadv batman skb recv() without bound, growing the kernel stack until it is exhausted.

Since refragmentation or fragments in fragments are not actually allowed, discard all packets which are still BATADV UNICAST FRAG packets after the defragmentation process.

Related Identifiers

CVE-2026-52916

Affected Products

Linux

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2026-52916 · Security Note
• https://git.kernel.org/stable/c/aea54d0bbe156d5ab7d00d68f66149ff41f4612a · Note
• https://git.kernel.org/stable/c/7138c35c9ad39a2fca6264af6b87466471f04ffc · Note
• https://git.kernel.org/stable/c/b54e459cf86943583c1aa2ee3081874e7ab1f5f3 · Note
• https://git.kernel.org/stable/c/5895ad21c7059a652da83fb817510f7a1e962abf · Note
• https://git.kernel.org/stable/c/bcda4814dc6524283c0b958882cb963d75fe411d · Note
• https://git.kernel.org/stable/c/5418be6c2e117bf8a316582795a8e3ff90f45e5d · Note
• https://git.kernel.org/stable/c/bc62216dc8e221e3781afa14430f45208bfa9af9 · Note
• https://git.kernel.org/stable/c/0c208fa3859e3a33a1c38bebc41d021166e94ac8 · Note