CVE-2026-31657

The batadv_bla_add_claim() function can replace the claim->backbone_gw pointer and release the last reference to the old backbone gateway, while other threads still dereference this pointer. The netlink dump path and batadv_bla_check_claim() function access claim->backbone_gw->orig and claim->backbone_gw->crc_lock fields without prior pinning of the underlying gateway object. The fix involves reusing the batadv_bla_claim_get_backbone_gw() function in both read code paths, so they operate on a stable reference to the gateway for the entire duration of the read operation.

An attacker can trigger a NULL pointer dereference or pointer race condition leading to memory corruption, which in practice can result in denial of service (kernel panic) or — depending on conditions — privilege escalation or remote code execution (RCE).

Patches available from the vendor should be applied according to the references — fixes have been published in the kernel.org (stable) repository under the indicated commits. It is recommended to update to the latest stable version of the kernel containing the mentioned patches.

Linux Kernel — versions indicated in the vendor's references (fix commits available in the kernel.org repository)