Critical 9.8Published Jun 24, 2026

CVE-2026-52931batman-adv: tp_meter: avoid use of uninit sender vars

Updated under an hour ago (Oct 28, 2026, 12:50 AM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: batman-adv: tp_meter: avoid use of uninit sender vars batadv_tp_recv_ack() and batadv_tp_stop() are only valid for tp_vars in the BATADV_TP_SENDER role. When called with a BATADV_TP_RECEIVER role, it proceeds to read sender-only members that were never initialized, leading to undefined behavior. This can be triggered when a node that is currently acting as a receiver in an ongoing tp_meter session receives a malicious ACK packet. Guard against this by checking tp_vars->role immediately after the lookup and bailing out if it is not BATADV_TP_SENDER, before any of those members are accessed.

CVSS: 9.8 CRITICAL (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-457
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 19, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	33a3bb4a3345bb511f9c69c913da95d4693e2a4e builds before 0e388af04b3958b178a1b979527f93eb46ea1fee; 33a3bb4a3345bb511f9c69c913da95d4693e2a4e builds before 1a21c055f66e78973712a4a1be2a554f1ee2e4f4; from 33a3bb4a3345bb511f9c69c913da95d4693e2a4e before 9884c9c02d3c90e9215db3c5128f59045d20ae91; from 33a3bb4a3345bb511f9c69c913da95d4693e2a4e before 53f931e0146ae5bdab4cba302646827d06b3794b; from 33a3bb4a3345bb511f9c69c913da95d4693e2a4e before ecdaa3e4d91040206afe21bc8a0d1198a0971ff3; from 33a3bb4a3345bb511f9c69c913da95d4693e2a4e before dc2ae5fbd2dadc26735092f140b246841d969a11; from 33a3bb4a3345bb511f9c69c913da95d4693e2a4e before 85397e48afe6be83ffca5ad3f4792296bfc81d3d; 33a3bb4a3345bb511f9c69c913da95d4693e2a4e builds before 6c65cf23d4c6170fcf5714c32aa64689718cb142	CNA record
linux linux_kernel linux:linux_kernel	from 4.8 before 5.10.258; from 5.11 before 5.15.209; from 5.16 before 6.1.175; from 6.2 before 6.6.142; from 6.7 before 6.12.92; from 6.13 before 6.18.34; from 6.19 before 7.0.11; 7.1; and 3 more ranges	NVD

References

References

https://git.kernel.org/stable/c/0e388af04b3958b178a1b979527f93eb46ea1fee	patch
https://git.kernel.org/stable/c/1a21c055f66e78973712a4a1be2a554f1ee2e4f4	patch
https://git.kernel.org/stable/c/9884c9c02d3c90e9215db3c5128f59045d20ae91	patch
https://git.kernel.org/stable/c/53f931e0146ae5bdab4cba302646827d06b3794b	patch
https://git.kernel.org/stable/c/ecdaa3e4d91040206afe21bc8a0d1198a0971ff3	patch
https://git.kernel.org/stable/c/dc2ae5fbd2dadc26735092f140b246841d969a11	patch
https://git.kernel.org/stable/c/85397e48afe6be83ffca5ad3f4792296bfc81d3d	patch
https://git.kernel.org/stable/c/6c65cf23d4c6170fcf5714c32aa64689718cb142	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.