CVE-2026-63835 in Linux
Summary
by MITRE • 07/19/2026
In the Linux kernel, the following vulnerability has been resolved:
batman-adv: v: prevent OGM aggregation on disabled hardif
When an interface gets disabled, the worker is correctly disabled by batadv_hardif_disable_interface() -> ... -> batadv_v_ogm_iface_disable(). In this process, the skb aggr_list is also freed.
But batadv_v_ogm_send_meshif() can still queue new skbs (via batadv_v_ogm_queue_on_if()) to the aggr_list. This will only stop after all cores can no longer find the RCU protected list of hard interfaces. These queued skbs will never be freed or consumed by batadv_v_ogm_aggr_work.
The batadv_v_ogm_iface_disable() function must block batadv_v_ogm_queue_on_if() to avoid leak of skbs.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/19/2026
The vulnerability in the Linux kernel's batman-adv module represents a critical memory management issue that arises from improper synchronization between interface disabling operations and packet queuing mechanisms within the mesh networking stack. This flaw occurs specifically when a hard interface is disabled, creating a race condition where queued network packets can persist indefinitely in memory structures. The vulnerability stems from the fact that while batadv_hardif_disable_interface() correctly disables the worker thread and frees the skb aggregation list through batadv_v_ogm_iface_disable(), it fails to prevent new packet queuing operations that continue to add skbs to this already disabled aggregation list.
The technical flaw manifests in the improper handling of RCU (Read-Copy-Update) protected data structures within the mesh routing implementation. When an interface is disabled, the system attempts to clean up resources by freeing the aggr_list, but batadv_v_ogm_send_meshif() function can still queue new skbs via batadv_v_ogm_queue_on_if() to this same aggregation list. This creates a situation where packets are enqueued to memory structures that are in the process of being destroyed, leading to memory leaks and potential system instability. The race condition exists because multiple cores may be accessing the same RCU protected list of hard interfaces, with some cores still finding references to the list while others have already begun cleanup operations.
The operational impact of this vulnerability extends beyond simple memory leaks to potentially cause system resource exhaustion and denial of service conditions within mesh network environments. Network packets that should be processed or discarded are instead left stranded in memory queues, consuming valuable system resources and potentially leading to complete system crashes when memory allocation limits are reached. This issue is particularly concerning in high-traffic mesh networks where the accumulation of these leaked skbs can rapidly consume available memory, affecting both network performance and overall system stability. The vulnerability affects any system running batman-adv with mesh networking enabled where interfaces may be dynamically disabled and re-enabled during normal operation.
Mitigation strategies for this vulnerability require implementing proper synchronization mechanisms to prevent new packet queuing operations during interface disablement processes. The solution involves modifying the batadv_v_ogm_iface_disable() function to block batadv_v_ogm_queue_on_if() calls during the disable sequence, ensuring that no new skbs can be added to aggregation lists that are being freed. This approach aligns with CWE-362 standards for race condition prevention and follows ATT&CK framework techniques for defensive measures against memory corruption vulnerabilities. The fix must ensure proper locking mechanisms are in place to prevent concurrent access to the aggregation list during interface disablement, preventing the scenario where packets are queued after the list has been freed but before all cores have stopped referencing it.
This vulnerability highlights the complexity of managing shared resources in kernel space networking modules and demonstrates the importance of careful synchronization when dealing with RCU-protected data structures. The issue represents a classic example of how seemingly independent operations can create dangerous race conditions when proper ordering and locking mechanisms are not maintained throughout the system lifecycle. System administrators should ensure that all batman-adv implementations are updated to versions containing this fix, particularly in production environments where mesh networking stability is critical. Regular monitoring of system memory usage and network packet processing queues should also be implemented to detect potential manifestation of this vulnerability before it leads to complete system failure or performance degradation.