Linux batadv BLA claim pointer deref potential use-after-free
CVE-2026-31657 Published on April 24, 2026
batman-adv: hold claim backbone gateways by reference
In the Linux kernel, the following vulnerability has been resolved:
batman-adv: hold claim backbone gateways by reference
batadv_bla_add_claim() can replace claim->backbone_gw and drop the old
gateway's last reference while readers still follow the pointer.
The netlink claim dump path dereferences claim->backbone_gw->orig and
takes claim->backbone_gw->crc_lock without pinning the underlying
backbone gateway. batadv_bla_check_claim() still has the same naked
pointer access pattern.
Reuse batadv_bla_claim_get_backbone_gw() in both readers so they operate
on a stable gateway reference until the read-side work is complete.
This keeps the dump and claim-check paths aligned with the lifetime
rules introduced for the other BLA claim readers.
Products Associated with CVE-2026-31657
Want to know whenever a new CVE is published for Linux Kernel? stack.watch will email you.
Affected Versions
Linux:- Version 23721387c409087fd3b97e274f34d3ddc0970b74 and below f4858832ddef2f39f21e30b7226bbcd3c4b2bc96 is affected.
- Version 23721387c409087fd3b97e274f34d3ddc0970b74 and below 2f55b58b5a0bbed192d60c444a45a49cdf1b545f is affected.
- Version 23721387c409087fd3b97e274f34d3ddc0970b74 and below 7962b522222628596ca9ecc8722efc95367aadbd is affected.
- Version 23721387c409087fd3b97e274f34d3ddc0970b74 and below 4dee4c0688443aaf5bbec74aa203c851d1d53c35 is affected.
- Version 23721387c409087fd3b97e274f34d3ddc0970b74 and below 1f2dc36c297d27733f1b380ea644cf15a361bd7b is affected.
- Version 23721387c409087fd3b97e274f34d3ddc0970b74 and below 82d8701b2c930d0e96b0dbc9115a218d791cb0d2 is affected.
- Version 3.5 is affected.
- Before 3.5 is unaffected.
- Version 6.1.169, <= 6.1.* is unaffected.
- Version 6.6.135, <= 6.6.* is unaffected.
- Version 6.12.82, <= 6.12.* is unaffected.
- Version 6.18.23, <= 6.18.* is unaffected.
- Version 6.19.13, <= 6.19.* is unaffected.
- Version 7.0, <= * is unaffected.