CVE-2026-52931

Description

In the Linux kernel, the following vulnerability has been resolved: batman-adv: tp_meter: avoid use of uninit sender vars batadv_tp_recv_ack() and batadv_tp_stop() are only valid for tp_vars in the BATADV_TP_SENDER role. When called with a BATADV_TP_RECEIVER role, it proceeds to read sender-only members that were never initialized, leading to undefined behavior. This can be triggered when a node that is currently acting as a receiver in an ongoing tp_meter session receives a malicious ACK packet. Guard against this by checking tp_vars->role immediately after the lookup and bailing out if it is not BATADV_TP_SENDER, before any of those members are accessed.

CVSS v3.1 Score

9.8

CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS — Exploit Prediction

0.0040

Probability of exploitation

0.32%

Percentile rank

EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.

References

Other References

https://git.kernel.org/stable/c/0e388af04b3958b178a1b979527f93eb46ea1fee https://git.kernel.org/stable/c/1a21c055f66e78973712a4a1be2a554f1ee2e4f4 https://git.kernel.org/stable/c/53f931e0146ae5bdab4cba302646827d06b3794b https://git.kernel.org/stable/c/6c65cf23d4c6170fcf5714c32aa64689718cb142 https://git.kernel.org/stable/c/85397e48afe6be83ffca5ad3f4792296bfc81d3d https://git.kernel.org/stable/c/9884c9c02d3c90e9215db3c5128f59045d20ae91 https://git.kernel.org/stable/c/dc2ae5fbd2dadc26735092f140b246841d969a11 https://git.kernel.org/stable/c/ecdaa3e4d91040206afe21bc8a0d1198a0971ff3

Frequently Asked Questions

What is CVE-2026-52931? +

In the Linux kernel, the following vulnerability has been resolved: batman-adv: tp_meter: avoid use of uninit sender vars batadv_tp_recv_ack() and batadv_tp_stop() are only valid for tp_vars in the BATADV_TP_SENDER role. When called with a BATADV_TP_RECEIVER role, it proceeds to read sender-only members that were never initialized, leading to undefined behavior. This can be triggered when a node that is currently acting as a receiver in an ongoing tp_meter session receives a malicious ACK packet. Guard against this by checking tp_vars->role immediately after the lookup and bailing out if it is not BATADV_TP_SENDER, before any of those members are accessed. It has a CVSS v3.1 base score of 9.8 (CRITICAL).

How severe is CVE-2026-52931? +

CVE-2026-52931 has a CVSS v3.1 score of 9.8 out of 10, rated CRITICAL. This is a critical vulnerability that should be patched immediately. The EPSS score is 0.0040, placing it in the 0th percentile for exploitation probability.

How do I check if I'm vulnerable to CVE-2026-52931? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.