CVE-2026-89948

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

batman-adv: bla: fix freeing of claims on meshif deletion

When the mesh interface is getting deleted, then

batadv_bla_del_backbone_claims() (via batadv_bla_purge_backbone_gw()) could

make sure that all claims gets removed. But this function is only executed

when bat_priv->bla.claim_hash is not NULL. And since batadv_bla_free() is

always setting it to NULL before it is (indirectly) called, it was never

actually executed.

But the batadv_bla_purge_claims() -> batadv_handle_unclaim() is at the

moment too fragile because the BLA code is not handling the rehashing in

batadv_bla_update_orig_address(). The stored backbone address doesn't have

to be the one actually used for the hash bucket selection during the

initial adding of the backbone. The batadv_handle_unclaim() can therefore

fail to find the respective backbone for the unclaim and then stop the

deletion.

But the actual backbone_gw object is not needed for the uncla

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References