{"api_version":"1","generated_at":"2026-09-16T23:29:18+00:00","cve":"CVE-2026-89951","urls":{"html":"https://cve.report/CVE-2026-89951","api":"https://cve.report/api/cve/CVE-2026-89951.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-89951","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-89951"},"summary":{"title":"batman-adv: fix stale receive device on merged fragments","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nbatman-adv: fix stale receive device on merged fragments\n\nFragment reassembly reuses the skb from the highest-numbered buffered\nfragment as the merged packet. When that fragment was received on a hard\ninterface which is deleted before the chain completes, the merged skb can\nre-enter the receive path with a stale skb->dev and skb_iif.\n\nbatadv_batman_skb_recv() passes such merged packets through the normal\nreceive handlers again. DAT and bridge loop avoidance both derive the ARP\nheader length from skb->dev, so they can dereference the freed net_device\nbefore the packet reaches the local mesh interface.\n\nRefresh the receive device metadata from the current receive device before\nrunning the packet handlers. This keeps internally reinjected merged\nfragments consistent with the normal receive path after hard interface\nteardown.","state":"PUBLISHED","assigner":"Linux","published_at":"2026-09-16 11:17:05","updated_at":"2026-09-16 15:18:19"},"problem_types":[],"metrics":[{"version":"3.1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","score":"8.8","severity":"HIGH","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"}},{"version":"3.1","source":"CNA","type":"DECLARED","score":"8.8","severity":"HIGH","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","data":{"baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}}],"references":[{"url":"https://git.kernel.org/stable/c/6df64825f8b199921120c685af2abca14b077331","name":"https://git.kernel.org/stable/c/6df64825f8b199921120c685af2abca14b077331","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/ad46c907d7d9975a285c1e89a4adde652eaa93f5","name":"https://git.kernel.org/stable/c/ad46c907d7d9975a285c1e89a4adde652eaa93f5","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/f830c2dfc1431764db9256b3d5db1695fc9a7f56","name":"https://git.kernel.org/stable/c/f830c2dfc1431764db9256b3d5db1695fc9a7f56","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/2dffc8c44b6e3347b3719c6419c07b4a18fea895","name":"https://git.kernel.org/stable/c/2dffc8c44b6e3347b3719c6419c07b4a18fea895","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/e91d2cc7441d89a45bad73ad9789159c7441cb80","name":"https://git.kernel.org/stable/c/e91d2cc7441d89a45bad73ad9789159c7441cb80","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/a2c272da99c2077088083c14961cf2f1e4506995","name":"https://git.kernel.org/stable/c/a2c272da99c2077088083c14961cf2f1e4506995","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/f4b4ae763b5d59319fad62a00c76676758e7dafa","name":"https://git.kernel.org/stable/c/f4b4ae763b5d59319fad62a00c76676758e7dafa","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/63d86250fa7cbe22451369bd1c0881dfc8190958","name":"https://git.kernel.org/stable/c/63d86250fa7cbe22451369bd1c0881dfc8190958","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-89951","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89951","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 610bfc6bc99bc83680d190ebc69359a05fc7f605 63d86250fa7cbe22451369bd1c0881dfc8190958 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 610bfc6bc99bc83680d190ebc69359a05fc7f605 f830c2dfc1431764db9256b3d5db1695fc9a7f56 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 610bfc6bc99bc83680d190ebc69359a05fc7f605 f4b4ae763b5d59319fad62a00c76676758e7dafa git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 610bfc6bc99bc83680d190ebc69359a05fc7f605 6df64825f8b199921120c685af2abca14b077331 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 610bfc6bc99bc83680d190ebc69359a05fc7f605 a2c272da99c2077088083c14961cf2f1e4506995 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 610bfc6bc99bc83680d190ebc69359a05fc7f605 e91d2cc7441d89a45bad73ad9789159c7441cb80 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 610bfc6bc99bc83680d190ebc69359a05fc7f605 2dffc8c44b6e3347b3719c6419c07b4a18fea895 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 610bfc6bc99bc83680d190ebc69359a05fc7f605 ad46c907d7d9975a285c1e89a4adde652eaa93f5 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 3.13","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 3.13 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.10.270 5.10.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.15.221 5.15.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.1.188 6.1.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.6.157 6.6.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.12.110 6.12.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.18.51 6.18.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.2.5 7.2.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.3-rc1 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/batman-adv/main.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"63d86250fa7cbe22451369bd1c0881dfc8190958","status":"affected","version":"610bfc6bc99bc83680d190ebc69359a05fc7f605","versionType":"git"},{"lessThan":"f830c2dfc1431764db9256b3d5db1695fc9a7f56","status":"affected","version":"610bfc6bc99bc83680d190ebc69359a05fc7f605","versionType":"git"},{"lessThan":"f4b4ae763b5d59319fad62a00c76676758e7dafa","status":"affected","version":"610bfc6bc99bc83680d190ebc69359a05fc7f605","versionType":"git"},{"lessThan":"6df64825f8b199921120c685af2abca14b077331","status":"affected","version":"610bfc6bc99bc83680d190ebc69359a05fc7f605","versionType":"git"},{"lessThan":"a2c272da99c2077088083c14961cf2f1e4506995","status":"affected","version":"610bfc6bc99bc83680d190ebc69359a05fc7f605","versionType":"git"},{"lessThan":"e91d2cc7441d89a45bad73ad9789159c7441cb80","status":"affected","version":"610bfc6bc99bc83680d190ebc69359a05fc7f605","versionType":"git"},{"lessThan":"2dffc8c44b6e3347b3719c6419c07b4a18fea895","status":"affected","version":"610bfc6bc99bc83680d190ebc69359a05fc7f605","versionType":"git"},{"lessThan":"ad46c907d7d9975a285c1e89a4adde652eaa93f5","status":"affected","version":"610bfc6bc99bc83680d190ebc69359a05fc7f605","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/batman-adv/main.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"3.13"},{"lessThan":"3.13","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.270","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.221","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.188","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.157","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.110","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.51","versionType":"semver"},{"lessThanOrEqual":"7.2.*","status":"unaffected","version":"7.2.5","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.3-rc1","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"5.10.270","versionStartIncluding":"3.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"5.15.221","versionStartIncluding":"3.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.1.188","versionStartIncluding":"3.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.6.157","versionStartIncluding":"3.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.12.110","versionStartIncluding":"3.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.18.51","versionStartIncluding":"3.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.2.5","versionStartIncluding":"3.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.3-rc1","versionStartIncluding":"3.13","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbatman-adv: fix stale receive device on merged fragments\n\nFragment reassembly reuses the skb from the highest-numbered buffered\nfragment as the merged packet. When that fragment was received on a hard\ninterface which is deleted before the chain completes, the merged skb can\nre-enter the receive path with a stale skb->dev and skb_iif.\n\nbatadv_batman_skb_recv() passes such merged packets through the normal\nreceive handlers again. DAT and bridge loop avoidance both derive the ARP\nheader length from skb->dev, so they can dereference the freed net_device\nbefore the packet reaches the local mesh interface.\n\nRefresh the receive device metadata from the current receive device before\nrunning the packet handlers. This keeps internally reinjected merged\nfragments consistent with the normal receive path after hard interface\nteardown."}],"metrics":[{"cvssV3_1":{"baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"scenarios":[{"lang":"en","value":"AV:A - Merged BATADV_UNICAST_FRAG packets re-enter batadv_batman_skb_recv() after ETH_P_BATMAN receive on a mesh hard interface; an attacker must inject those frames on the same L2 mesh segment (WiFi IBSS/802.11s, Ethernet backbone, or community-mesh overlay), not via arbitrary Internet routing.\nAC:L - The attacker fully controls fragment headers, inner ARP payload, and both send steps (buffer the highest-numbered fragment, then complete the chain on a remaining active hard interface). In-window fragments are not purged on NETDEV_UNREGISTER, so the stale skb->dev UAF needs no uninfluenceable heap layout.\nPR:N - batadv_batman_skb_recv() is an unauthenticated packet_type handler; any adjacent mesh peer can send BATADV_UNICAST_FRAG frames. Originator presence is obtained by sending OGMs or spoofing a MAC learned from the mesh, with no local account or CAP_NET_ADMIN on the victim.\nUI:N - Exploitation requires only attacker-sent mesh fragments; the kernel buffers, merges, and runs DAT ARP parsing in NET_RX_SOFTIRQ without any victim click, mount, or extra administrative action at exploit time.\nS:U - The use-after-free is of a kernel net_device in batman-adv on the victim host and does not cross a VM/host, IOMMU, or sandbox security authority.\nC:H - After hard-interface unregister, batadv_arp_get_type() calls arp_hdr_len(skb->dev) on the merged skb and reads a freed net_device. A kernel-object UAF is high confidentiality impact because reclaim/spray of that object can disclose heap contents.\nI:H - This is a use-after-free of struct net_device on the fragment-merge receive path. Heap spraying the freed object yields attacker-controlled device fields consumed during packet parsing, a memory-corruption primitive suitable for integrity compromise or control-flow hijacking.\nA:H - Dereferencing a freed net_device from NET_RX_SOFTIRQ can oops, panic, or hang when the object is poisoned or unmapped, denying mesh and host availability even without a full exploit."}]}],"providerMetadata":{"dateUpdated":"2026-09-16T14:40:34.244Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/63d86250fa7cbe22451369bd1c0881dfc8190958"},{"url":"https://git.kernel.org/stable/c/f830c2dfc1431764db9256b3d5db1695fc9a7f56"},{"url":"https://git.kernel.org/stable/c/f4b4ae763b5d59319fad62a00c76676758e7dafa"},{"url":"https://git.kernel.org/stable/c/6df64825f8b199921120c685af2abca14b077331"},{"url":"https://git.kernel.org/stable/c/a2c272da99c2077088083c14961cf2f1e4506995"},{"url":"https://git.kernel.org/stable/c/e91d2cc7441d89a45bad73ad9789159c7441cb80"},{"url":"https://git.kernel.org/stable/c/2dffc8c44b6e3347b3719c6419c07b4a18fea895"},{"url":"https://git.kernel.org/stable/c/ad46c907d7d9975a285c1e89a4adde652eaa93f5"}],"title":"batman-adv: fix stale receive device on merged fragments","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2026-89951","datePublished":"2026-09-16T10:32:36.179Z","dateReserved":"2026-09-11T19:38:34.777Z","dateUpdated":"2026-09-16T14:40:34.244Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-09-16 11:17:05","lastModifiedDate":"2026-09-16 15:18:19","problem_types":[],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"89951","Ordinal":"1","Title":"batman-adv: fix stale receive device on merged fragments","CVE":"CVE-2026-89951","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"89951","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\nbatman-adv: fix stale receive device on merged fragments\n\nFragment reassembly reuses the skb from the highest-numbered buffered\nfragment as the merged packet. When that fragment was received on a hard\ninterface which is deleted before the chain completes, the merged skb can\nre-enter the receive path with a stale skb->dev and skb_iif.\n\nbatadv_batman_skb_recv() passes such merged packets through the normal\nreceive handlers again. DAT and bridge loop avoidance both derive the ARP\nheader length from skb->dev, so they can dereference the freed net_device\nbefore the packet reaches the local mesh interface.\n\nRefresh the receive device metadata from the current receive device before\nrunning the packet handlers. This keeps internally reinjected merged\nfragments consistent with the normal receive path after hard interface\nteardown.","Type":"Description","Title":"batman-adv: fix stale receive device on merged fragments"}]}}}