CVE-2026-52931
published 2026-06-24CVE-2026-52931: In the Linux kernel, the following vulnerability has been resolved: batman-adv: tp_meter: avoid use of uninit sender vars batadv_tp_recv_ack() and…
PriorityP346critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.40%
32.5th percentile
In the Linux kernel, the following vulnerability has been resolved:
batman-adv: tp_meter: avoid use of uninit sender vars
batadv_tp_recv_ack() and batadv_tp_stop() are only valid for tp_vars in the
BATADV_TP_SENDER role. When called with a BATADV_TP_RECEIVER role, it
proceeds to read sender-only members that were never initialized, leading
to undefined behavior.
This can be triggered when a node that is currently acting as a receiver in
an ongoing tp_meter session receives a malicious ACK packet.
Guard against this by checking tp_vars->role immediately after the
lookup and bailing out if it is not BATADV_TP_SENDER, before any of
those members are accessed.
Affected
20 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| linux | linux | — | — |
| linux | linux | >= 33a3bb4a3345bb511f9c69c913da95d4693e2a4e < 0e388af04b3958b178a1b979527f93eb46ea1fee | 0e388af04b3958b178a1b979527f93eb46ea1fee |
| linux | linux | >= 33a3bb4a3345bb511f9c69c913da95d4693e2a4e < 1a21c055f66e78973712a4a1be2a554f1ee2e4f4 | 1a21c055f66e78973712a4a1be2a554f1ee2e4f4 |
| linux | linux | >= 33a3bb4a3345bb511f9c69c913da95d4693e2a4e < 9884c9c02d3c90e9215db3c5128f59045d20ae91 | 9884c9c02d3c90e9215db3c5128f59045d20ae91 |
| linux | linux | >= 33a3bb4a3345bb511f9c69c913da95d4693e2a4e < 53f931e0146ae5bdab4cba302646827d06b3794b | 53f931e0146ae5bdab4cba302646827d06b3794b |
| linux | linux | >= 33a3bb4a3345bb511f9c69c913da95d4693e2a4e < ecdaa3e4d91040206afe21bc8a0d1198a0971ff3 | ecdaa3e4d91040206afe21bc8a0d1198a0971ff3 |
| linux | linux | >= 33a3bb4a3345bb511f9c69c913da95d4693e2a4e < dc2ae5fbd2dadc26735092f140b246841d969a11 | dc2ae5fbd2dadc26735092f140b246841d969a11 |
| linux | linux | >= 33a3bb4a3345bb511f9c69c913da95d4693e2a4e < 85397e48afe6be83ffca5ad3f4792296bfc81d3d | 85397e48afe6be83ffca5ad3f4792296bfc81d3d |
| linux | linux | >= 33a3bb4a3345bb511f9c69c913da95d4693e2a4e < 6c65cf23d4c6170fcf5714c32aa64689718cb142 | 6c65cf23d4c6170fcf5714c32aa64689718cb142 |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 4.8 < 5.10.258 | 5.10.258 |
| linux | linux_kernel | >= 5.11 < 5.15.209 | 5.15.209 |
| linux | linux_kernel | >= 5.16 < 6.1.175 | 6.1.175 |
| linux | linux_kernel | >= 6.13 < 6.18.34 | 6.18.34 |
| linux | linux_kernel | >= 6.19 < 7.0.11 | 7.0.11 |
| linux | linux_kernel | >= 6.2 < 6.6.142 | 6.6.142 |
| linux | linux_kernel | >= 6.7 < 6.12.92 | 6.12.92 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kernel: batman-adv: tp_meter: avoid use of uninit sender vars
vendor_redhat·2026-06-24
CVE-2026-52931 CWE-824 kernel: batman-adv: tp_meter: avoid use of uninit sender vars
kernel: batman-adv: tp_meter: avoid use of uninit sender vars
A flaw was found in the `batman-adv` `tp_meter` module of the Linux kernel. A remote attacker could exploit this vulnerability by sending a specially crafted acknowledgment (ACK) packet to a node configured as a receiver in an ongoing `tp_meter` session. This could lead to the use of uninitialized sender variables, resulting in undefined behavior and potentially a denial of service.
Package: kernel (Red Hat Enterprise Linux 10) - Not affected
Package: kernel (Red Hat Enterprise Linux 6) - Not affected
Package: kernel (Red Hat Enterprise Linux 7) - Not affected
Package: kernel-rt (Red Hat Enterprise Linux 7) - Not affected
Package: kernel (Red Hat Enterprise Linux 8) - Not affected
Package: kernel-rt (Red Hat Enterprise Li
GHSA
In the Linux kernel, the following vulnerability has been resolved: batman-adv: tp_meter: avoid use of uninit sender vars batadv_tp_recv_ack() and batadv_tp_stop() are only valid for tp_vars in the
ghsa_unreviewed·2026-06-24
CVE-2026-52931 In the Linux kernel, the following vulnerability has been resolved: batman-adv: tp_meter: avoid use of uninit sender vars batadv_tp_recv_ack() and batadv_tp_stop() are only valid for tp_vars in the
In the Linux kernel, the following vulnerability has been resolved:
batman-adv: tp_meter: avoid use of uninit sender vars
batadv_tp_recv_ack() and batadv_tp_stop() are only valid for tp_vars in the
BATADV_TP_SENDER role. When called with a BATADV_TP_RECEIVER role, it
proceeds to read sender-only members that were never initialized, leading
to undefined behavior.
This can be triggered when a node that is currently acting as a receiver in
an ongoing tp_meter session receives a malicious ACK packet.
Guard against this by checking tp_vars->role immediately after the
lookup and bailing out if it is not BATADV_TP_SENDER, before any of
those members are accessed.
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/0e388af04b3958b178a1b979527f93eb46ea1feehttps://git.kernel.org/stable/c/1a21c055f66e78973712a4a1be2a554f1ee2e4f4https://git.kernel.org/stable/c/53f931e0146ae5bdab4cba302646827d06b3794bhttps://git.kernel.org/stable/c/6c65cf23d4c6170fcf5714c32aa64689718cb142https://git.kernel.org/stable/c/85397e48afe6be83ffca5ad3f4792296bfc81d3dhttps://git.kernel.org/stable/c/9884c9c02d3c90e9215db3c5128f59045d20ae91https://git.kernel.org/stable/c/dc2ae5fbd2dadc26735092f140b246841d969a11https://git.kernel.org/stable/c/ecdaa3e4d91040206afe21bc8a0d1198a0971ff3
2026-06-24
Published