CVE-2026-43382: batman-adv: Avoid double-rtnl_lock ELP metric worker
In the Linux kernel, the following vulnerability has been resolved:
batman-adv: Avoid double-rtnllock ELP metric worker
batadvvelpgetthroughput() might be called when the RTNL lock is already held. This could be problematic when the work queue item is cancelled via canceldelayedworksync() in batadvvelpifacedisable(). In this case, an rtnllock() would cause a deadlock.
To avoid this, rtnltrylock() was used in this function to skip the retrieval of the ethtool information in case the RTNL lock was already held.
But for cfg80211 interfaces, batadvgetrealnetdev() was called - which also uses rtnllock(). The approach for ethtoolgetlinkksettings() must also be used instead and the lockless version batadvgetrealnetdev() has to be called.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-43382?
CVE-2026-43382 has a medium severity rating of 5.5 on the CVSS scale.
How do I fix CVE-2026-43382?
To fix CVE-2026-43382, apply the available patch from the Linux kernel updates.
What impact does CVE-2026-43382 have on systems?
CVE-2026-43382 could lead to issues when the batman-adv metric worker is executed while holding the RTNL lock, potentially resulting in system instability.
Which software is affected by CVE-2026-43382?
CVE-2026-43382 affects the Linux kernel and specifically the batman-adv module.
Is there a known exploit for CVE-2026-43382?
As of now, there is no publicly available exploit for CVE-2026-43382.