From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 83E444DF4D7 for ; Wed, 16 Sep 2026 10:40:29 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789555234; cv=none; b=lKwqAfdNTRFB5VKMsGXUUHvHoiL0RHKXGT10HC/7WKRsudduB965YN8YkCVTMod6oCZP/zmDdEs6uAp8RK62z/kcRkmub0kZ/S/6nsJfQHg2Vr1bDhdoYwwlSbLvRZhv+HKNRzj1cgtMosZRpzYGaKfooO8gmtyAJP3KfeuMie4= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789555234; c=relaxed/simple; bh=jp+QQpFEDjpf/lvWGtt8wV42lkhWFN5c9BXgkyK9wfk=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=XFH92qWKWCY9EuVusAfTLIeLiyhkccF/0k001WUmhWtnf+nITOn2gX8x2uAEL3JYDq24Tkrz1340VMmpm5a/x95zgdJztAZopp6k76SWcJ2vbQgaMzh96SwaVreD/c0hV6dQ6avdpT8nyAKtD9muDVZAnCBs9ntJLjiPqcdvH8I= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=INfzq9DY; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="INfzq9DY" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 0A1A41F00898; Wed, 16 Sep 2026 10:40:28 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1789555229; bh=ItW6oEiUhpauzHpZoSLoHPXts/dplFixTT/lRH0O7uU=; h=From:To:Cc:Subject:Date:Reply-To; b=INfzq9DYDakithU63vtyxZVkERacwTbimb9CPuPqOFZIFzAYM289qUDIr9ZmG1z/I FMXmK1ZSahRnBNHHr7WE2m3eyBnBLQ12PqQm1o83iKqAJj0X7REmkyZTF7oJIF7ME+ GDB9c3Luyamz+YkTaXnt/vQPAzmzHVVsoPUhMuU8= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-89948: batman-adv: bla: fix freeing of claims on meshif deletion Date: Wed, 16 Sep 2026 11:31:18 +0100 Message-ID: <2026091648-CVE-2026-89948-8e2d@gregkh> X-Mailer: git-send-email 2.55.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=4235; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=xtDrv7GJ1bldA3PWgH9RrQ8gjDFl8Jldr/zCzcLyars=; b=owGbwMvMwCRo6H6F97bub03G02pJDFmr8udWXPNyl7KNf37mtJ1oVtTNI4232jg3by/Vrmttb UxRezyvI5aFQZCJQVZMkeXLNp6j+ysOKXoZ2p6GmcPKBDKEgYtTACayyI9hvt+cTV9uOs+c6G98 9fC0nMts99x/tTAs2BiqyX9Va/nGlmpNsxrP4g652X+mAQA= X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: batman-adv: bla: fix freeing of claims on meshif deletion When the mesh interface is getting deleted, then batadv_bla_del_backbone_claims() (via batadv_bla_purge_backbone_gw()) could make sure that all claims gets removed. But this function is only executed when bat_priv->bla.claim_hash is not NULL. And since batadv_bla_free() is always setting it to NULL before it is (indirectly) called, it was never actually executed. But the batadv_bla_purge_claims() -> batadv_handle_unclaim() is at the moment too fragile because the BLA code is not handling the rehashing in batadv_bla_update_orig_address(). The stored backbone address doesn't have to be the one actually used for the hash bucket selection during the initial adding of the backbone. The batadv_handle_unclaim() can therefore fail to find the respective backbone for the unclaim and then stop the deletion. But the actual backbone_gw object is not needed for the unclaim because all relevant information is always provided by the caller. And the check for the existence of the backbone_gw doesn't provide any additional security check for the deletion of a claim. The Linux kernel CVE team has assigned CVE-2026-89948 to this issue. Affected and fixed versions =========================== Issue introduced in 3.5 with commit 23721387c409087fd3b97e274f34d3ddc0970b74 and fixed in 5.10.270 with commit 844a95a734f178d56c7acce14c5cce2cecff7e1a Issue introduced in 3.5 with commit 23721387c409087fd3b97e274f34d3ddc0970b74 and fixed in 5.15.221 with commit baeb1a28fd8e2f68193650d3664a8cd1adfd85c6 Issue introduced in 3.5 with commit 23721387c409087fd3b97e274f34d3ddc0970b74 and fixed in 6.1.188 with commit aacffa780a37e06cd5a13d33740a6e96c3a67e6c Issue introduced in 3.5 with commit 23721387c409087fd3b97e274f34d3ddc0970b74 and fixed in 6.6.157 with commit 76aedcde5a2489cc971d4d1e396e784a49565e96 Issue introduced in 3.5 with commit 23721387c409087fd3b97e274f34d3ddc0970b74 and fixed in 6.12.110 with commit f50edb69082a8ba990cc23d642089829f99afe6a Issue introduced in 3.5 with commit 23721387c409087fd3b97e274f34d3ddc0970b74 and fixed in 6.18.51 with commit 871acdf97f64cee8398f72b88b89e8b4f4816dbe Issue introduced in 3.5 with commit 23721387c409087fd3b97e274f34d3ddc0970b74 and fixed in 7.2.5 with commit 9a0c47023d3254048a1588534755d4476bcc3abc Issue introduced in 3.5 with commit 23721387c409087fd3b97e274f34d3ddc0970b74 and fixed in 7.3-rc1 with commit 8d128c932bced74e3b1625ba3d7c78ef122a88a7 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-89948 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: net/batman-adv/bridge_loop_avoidance.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/844a95a734f178d56c7acce14c5cce2cecff7e1a https://git.kernel.org/stable/c/baeb1a28fd8e2f68193650d3664a8cd1adfd85c6 https://git.kernel.org/stable/c/aacffa780a37e06cd5a13d33740a6e96c3a67e6c https://git.kernel.org/stable/c/76aedcde5a2489cc971d4d1e396e784a49565e96 https://git.kernel.org/stable/c/f50edb69082a8ba990cc23d642089829f99afe6a https://git.kernel.org/stable/c/871acdf97f64cee8398f72b88b89e8b4f4816dbe https://git.kernel.org/stable/c/9a0c47023d3254048a1588534755d4476bcc3abc https://git.kernel.org/stable/c/8d128c932bced74e3b1625ba3d7c78ef122a88a7