CVE-2026-64094: batman-adv: bla: avoid NULL-ptr deref for claim via dropped interface
In the Linux kernel, the following vulnerability has been resolved:
batman-adv: bla: avoid NULL-ptr deref for claim via dropped interface
Without rtnllock held, a hardif might be retrieved as primary interface of a meshif, but then (while operating on this interface) getting decoupled from the mesh interface. In this case, the meshif still exists but the pointer from the primary hardif to the meshif is set to NULL.
The meshiface must be checked first to be non-NULL before continuing to send an ARP request using meshif.
Affected Software
Remediation
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The CVSS vector indicates local access and low privileges are required. No user interaction is required.
What is the likely impact of successful exploitation?
The issue can cause a NULL-pointer dereference, with availability impact rated High. The provided CVSS vector indicates no confidentiality or integrity impact.
Under what condition does the vulnerable path occur?
It occurs when a batman-adv hard interface is obtained as a mesh interface's primary interface and is then decoupled from that mesh interface while it is being used. The hard interface's mesh-interface pointer can become NULL before an ARP request is sent.
Is a fix available?
Yes. A patch is available, with stable kernel references provided for the resolved change.