Medium 5.5Published Jun 24, 2026

CVE-2026-52916batman-adv: frag: disallow unicast fragment in fragment

Updated under an hour ago (Oct 27, 2026, 10:30 PM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: batman-adv: frag: disallow unicast fragment in fragment batadv_frag_skb_buffer() is called by batadv_batman_skb_recv() when a BATADV_UNICAST_FRAG packet is received. Once all fragments are collected and the packet is reassembled, batadv_recv_frag_packet() calls batadv_batman_skb_recv() again to process the defragmented payload. A malicious sender can craft a BATADV_UNICAST_FRAG packet whose reassembled payload is itself a BATADV_UNICAST_FRAG packet (matryoshka-style nesting). Each nesting level recurses through batadv_batman_skb_recv() without bound, growing the kernel stack until it is exhausted. Since refragmentation or fragments in fragments are not actually allowed, discard all packets which are still BATADV_UNICAST_FRAG packets after the defragmentation process.

CVSS: 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Analyzed
Record last updated: Jun 24, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	610bfc6bc99bc83680d190ebc69359a05fc7f605 builds before 0c208fa3859e3a33a1c38bebc41d021166e94ac8; from 610bfc6bc99bc83680d190ebc69359a05fc7f605 before bcda4814dc6524283c0b958882cb963d75fe411d; from 610bfc6bc99bc83680d190ebc69359a05fc7f605 before aea54d0bbe156d5ab7d00d68f66149ff41f4612a; from 610bfc6bc99bc83680d190ebc69359a05fc7f605 before b54e459cf86943583c1aa2ee3081874e7ab1f5f3; from 610bfc6bc99bc83680d190ebc69359a05fc7f605 before 5418be6c2e117bf8a316582795a8e3ff90f45e5d; from 610bfc6bc99bc83680d190ebc69359a05fc7f605 before 5895ad21c7059a652da83fb817510f7a1e962abf; from 610bfc6bc99bc83680d190ebc69359a05fc7f605 before 7138c35c9ad39a2fca6264af6b87466471f04ffc; from 610bfc6bc99bc83680d190ebc69359a05fc7f605 before bc62216dc8e221e3781afa14430f45208bfa9af9	CNA record
linux linux_kernel linux:linux_kernel	from 3.13 before 5.10.258; from 5.11 before 5.15.209; from 5.16 before 6.1.175; from 6.2 before 6.6.142; from 6.7 before 6.12.92; from 6.13 before 6.18.34; from 6.19 before 7.0.11; 7.1; and 3 more ranges	NVD

References

References

https://git.kernel.org/stable/c/0c208fa3859e3a33a1c38bebc41d021166e94ac8	patch
https://git.kernel.org/stable/c/bcda4814dc6524283c0b958882cb963d75fe411d	patch
https://git.kernel.org/stable/c/aea54d0bbe156d5ab7d00d68f66149ff41f4612a	patch
https://git.kernel.org/stable/c/b54e459cf86943583c1aa2ee3081874e7ab1f5f3	patch
https://git.kernel.org/stable/c/5418be6c2e117bf8a316582795a8e3ff90f45e5d	patch
https://git.kernel.org/stable/c/5895ad21c7059a652da83fb817510f7a1e962abf	patch
https://git.kernel.org/stable/c/7138c35c9ad39a2fca6264af6b87466471f04ffc	patch
https://git.kernel.org/stable/c/bc62216dc8e221e3781afa14430f45208bfa9af9	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.