CVE-2026-89950: batman-adv: mcast: linearize skbuff for packet generation
In the Linux kernel, the following vulnerability has been resolved:
batman-adv: mcast: linearize skbuff for packet generation
batadvmcastforwpacket() and batadvmcastforwscrape() is not only called (indirectly) by the unsharing+linearizing batadvrecvmcastpacket() handler. When it is called (indirectly) by batadvmcastforwmcsend() then it will be unshared but not linearized. The SKBLINEARASSERT() can therefore cause a fatal BUG().
The linearization should happen during the expansion of the head because the scrape function can be hit already during the initial batadvmcastforwmode() selection code:
batadvinterfacetx batadvmcastforwmode batadvmcastforwmodebycount() batadvmcastforwpush() -> calls batadvmcastforwexpandhead() before everything else batadvmcastforwpushtvlvs() batadvmcastforwpushdests() batadvmcastforwpushadjustpadding() batadvmcastforwscrape()
Event History
Frequently Asked Questions
What condition triggers the failure?
The failure can occur when batadv_mcast_forw_packet() or batadv_mcast_forw_scrape() is reached through batadv_mcast_forw_mcsend(). In that path, the socket buffer is unshared but not linearized, so SKB_LINEAR_ASSERT() can trigger a fatal BUG().
What is the operational impact?
The described impact is a fatal kernel BUG, which can cause a system crash or denial of service. The issue affects multicast packet-generation paths in batman-adv.
What was changed to address the issue?
The fix linearizes the socket buffer while expanding its head in batadv_mcast_forw_expand_head(). This occurs early enough to cover paths where batadv_mcast_forw_scrape() can be called during multicast forwarding mode selection.