CVE-2026-89948

CVE CVE-2026-89948EUVD EUVD-2026-80548Published 2026-09-16T10:32:34.000Z

What the advisory describes

In the Linux kernel, the following vulnerability has been resolved: batman-adv: bla: fix freeing of claims on meshif deletion When the mesh interface is getting deleted, then batadv_bla_del_backbone_claims() (via batadv_bla_purge_backbone_gw()) could make sure that all claims gets removed. But this function is only executed when bat_priv->bla.claim_hash is not NULL. And since batadv_bla_free() is always setting it to NULL before it is (indirectly) called, it was never actually executed. But the batadv_bla_purge_claims() -> batadv_handle_unclaim() is at the moment too fragile because the BLA code is not handling the rehashing in batadv_bla_update_orig_address(). The stored backbone address doesn't have to be the one actually used for the hash bucket selection during the initial adding of the backbone. The batadv_handle_unclaim() can therefore fail to find the respective backbone for the unclaim and then stop the deletion. But the actual backbone_gw object is not needed for the unclaim because all relevant information is always provided by the caller. And the check for the existence of the backbone_gw doesn't provide any additional security check for the deletion of a claim.

Source: EUVD (ENISA), in the words of the advisory.

Products the advisory names

These come from the advisory itself, not from any check we performed.

• Linux — Linux 23721387c409087fd3b97e274f34d3ddc0970b74 <f50edb69082a8ba990cc23d642089829f99afe6a; 23721387c409087fd3b97e274f34d3ddc0970b74 <871acdf97f64cee8398f72b88b89e8b4f4816dbe; patch: 6.12.110; 23721387c409087fd3b97e274f34d3ddc0970b74 <aacffa780a37e06cd5a13d33740a6e96c3a67e6c; patch: 7.2.5; patch: 0; patch: 7.3-rc1; patch: 5.15.221; patch: 5.10.270; 23721387c409087fd3b97e274f34d3ddc0970b74 <8d128c932bced74e3b1625ba3d7c78ef122a88a7; 23721387c409087fd3b97e274f34d3ddc0970b74 <baeb1a28fd8e2f68193650d3664a8cd1adfd85c6; 3.5; patch: 6.18.51; 23721387c409087fd3b97e274f34d3ddc0970b74 <76aedcde5a2489cc971d4d1e396e784a49565e96; 23721387c409087fd3b97e274f34d3ddc0970b74 <844a95a734f178d56c7acce14c5cce2cecff7e1a; patch: 6.6.157; patch: 6.1.188; 23721387c409087fd3b97e274f34d3ddc0970b74 <9a0c47023d3254048a1588534755d4476bcc3abc

The versions shown are the advisory's own. Patchlage compares no version numbers and derives no judgement from them — which version is installed is something a person has to look up.

Carried in the product catalogue

An estate covering these products can be recorded in Patchlage. An advisory about them appears in the next morning's situation report.

• Linux — Linux

Patchlage reports hits and suspected hits. About everything else this system says nothing — neither this page nor the situation report ever claims that an estate is safe.