CVE-2026-89951batman-adv: fix stale receive device on merged fragments
- 8.8HighCVSS base score
- 0.35%Exploitation in 30 daysEPSS · top 70% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: batman-adv: fix stale receive device on merged fragments Fragment reassembly reuses the skb from the highest-numbered buffered fragment as the merged packet. When that fragment was received on a hard interface which is deleted before the chain completes, the merged skb can re-enter the receive path with a stale skb->dev and skb_iif. batadv_batman_skb_recv() passes such merged packets through the normal receive handlers again. DAT and bridge loop avoidance both derive the ARP header length from skb->dev, so they can dereference the freed net_device before the packet reaches the local mesh interface. Refresh the receive device metadata from the current receive device before running the packet handlers. This keeps internally reinjected merged fragments consistent with the normal receive path after hard interface teardown.
Timeline
ID reserved
By Linux
- 5 days later
· 5 days later
Published
- 33 days later
· 33 days later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| LinuxCNA (assigner) | 3.1 | High8.8 | CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVDNVD · Received | 3.1 | High8.8 | CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 0.35% · top 70% of all CVEs (13 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.8.
Affected products
- affected 610bfc6bc99bc83680d190ebc69359a05fc7f605 – < 63d86250fa7cbe22451369bd1c0881dfc8190958
- affected 610bfc6bc99bc83680d190ebc69359a05fc7f605 – < f830c2dfc1431764db9256b3d5db1695fc9a7f56
- affected 610bfc6bc99bc83680d190ebc69359a05fc7f605 – < f4b4ae763b5d59319fad62a00c76676758e7dafa
- affected 610bfc6bc99bc83680d190ebc69359a05fc7f605 – < 6df64825f8b199921120c685af2abca14b077331
- affected 610bfc6bc99bc83680d190ebc69359a05fc7f605 – < a2c272da99c2077088083c14961cf2f1e4506995
- affected 610bfc6bc99bc83680d190ebc69359a05fc7f605 – < e91d2cc7441d89a45bad73ad9789159c7441cb80
- affected 610bfc6bc99bc83680d190ebc69359a05fc7f605 – < 2dffc8c44b6e3347b3719c6419c07b4a18fea895
- affected 610bfc6bc99bc83680d190ebc69359a05fc7f605 – < ad46c907d7d9975a285c1e89a4adde652eaa93f5
- affected 3.13
- unaffected < 3.13
- unaffected 5.10.270 – ≤ 5.10.*
- unaffected 5.15.221 – ≤ 5.15.*
- unaffected 6.1.188 – ≤ 6.1.*
- unaffected 6.6.157 – ≤ 6.6.*
- unaffected 6.12.110 – ≤ 6.12.*
- unaffected 6.18.51 – ≤ 6.18.*
- unaffected 7.2.5 – ≤ 7.2.*
- unaffected 7.3 – ≤ *
References
References8
- https://git.kernel.org/stable/c/63d86250fa7cbe22451369bd1c0881dfc8190958 (opens in a new tab)
- https://git.kernel.org/stable/c/f830c2dfc1431764db9256b3d5db1695fc9a7f56 (opens in a new tab)
- https://git.kernel.org/stable/c/f4b4ae763b5d59319fad62a00c76676758e7dafa (opens in a new tab)
- https://git.kernel.org/stable/c/6df64825f8b199921120c685af2abca14b077331 (opens in a new tab)
- https://git.kernel.org/stable/c/a2c272da99c2077088083c14961cf2f1e4506995 (opens in a new tab)
- https://git.kernel.org/stable/c/e91d2cc7441d89a45bad73ad9789159c7441cb80 (opens in a new tab)
- https://git.kernel.org/stable/c/2dffc8c44b6e3347b3719c6419c07b4a18fea895 (opens in a new tab)
- https://git.kernel.org/stable/c/ad46c907d7d9975a285c1e89a4adde652eaa93f5 (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2026-80551 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-89951)Record last updated .