CVE-2026-89951

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the batman-adv module where fragment reassembly reuses the socket buffer (skb) from the highest-numbered buffered fragment as the merged packet. If that fragment was received on a hard interface that is deleted before the reassembly chain completes, the merged skb may re-enter the receive path with a stale skb->dev and skb iif. The function batadv batman skb recv() then passes these merged packets through normal receive handlers. Consequently, DAT and bridge loop avoidance mechanisms, which derive the ARP header length from skb->dev, may dereference a freed net device before the packet reaches the local mesh interface.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.