CVE-2026-52916

Description

In the Linux kernel, the following vulnerability has been resolved: batman-adv: frag: disallow unicast fragment in fragment batadv_frag_skb_buffer() is called by batadv_batman_skb_recv() when a BATADV_UNICAST_FRAG packet is received. Once all fragments are collected and the packet is reassembled, batadv_recv_frag_packet() calls batadv_batman_skb_recv() again to process the defragmented payload. A malicious sender can craft a BATADV_UNICAST_FRAG packet whose reassembled payload is itself a BATADV_UNICAST_FRAG packet (matryoshka-style nesting). Each nesting level recurses through batadv_batman_skb_recv() without bound, growing the kernel stack until it is exhausted. Since refragmentation or fragments in fragments are not actually allowed, discard all packets which are still BATADV_UNICAST_FRAG packets after the defragmentation process.

EPSS — Exploit Prediction

0.0018

Probability of exploitation

0.07%

Percentile rank

EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.

References

Other References

https://git.kernel.org/stable/c/0c208fa3859e3a33a1c38bebc41d021166e94ac8 https://git.kernel.org/stable/c/5418be6c2e117bf8a316582795a8e3ff90f45e5d https://git.kernel.org/stable/c/5895ad21c7059a652da83fb817510f7a1e962abf https://git.kernel.org/stable/c/7138c35c9ad39a2fca6264af6b87466471f04ffc https://git.kernel.org/stable/c/aea54d0bbe156d5ab7d00d68f66149ff41f4612a https://git.kernel.org/stable/c/b54e459cf86943583c1aa2ee3081874e7ab1f5f3 https://git.kernel.org/stable/c/bc62216dc8e221e3781afa14430f45208bfa9af9 https://git.kernel.org/stable/c/bcda4814dc6524283c0b958882cb963d75fe411d

Frequently Asked Questions

What is CVE-2026-52916? +

In the Linux kernel, the following vulnerability has been resolved: batman-adv: frag: disallow unicast fragment in fragment batadv_frag_skb_buffer() is called by batadv_batman_skb_recv() when a BATADV_UNICAST_FRAG packet is received. Once all fragments are collected and the packet is reassembled, batadv_recv_frag_packet() calls batadv_batman_skb_recv() again to process the defragmented payload. A malicious sender can craft a BATADV_UNICAST_FRAG packet whose reassembled payload is itself a BATADV_UNICAST_FRAG packet (matryoshka-style nesting). Each nesting level recurses through batadv_batman_skb_recv() without bound, growing the kernel stack until it is exhausted. Since refragmentation or fragments in fragments are not actually allowed, discard all packets which are still BATADV_UNICAST_FRAG packets after the defragmentation process.

How do I check if I'm vulnerable to CVE-2026-52916? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Description

EPSS — Exploit Prediction

References

Other References

Frequently Asked Questions

Don't wait for an exploit