CVE-2026-89948: batman-adv: bla: fix freeing of claims on meshif deletion

CVE-2026-89948: batman-adv: bla: fix freeing of claims on meshif deletion

[Greg Kroah-Hartman]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

batman-adv: bla: fix freeing of claims on meshif deletion

When the mesh interface is getting deleted, then
batadv_bla_del_backbone_claims() (via batadv_bla_purge_backbone_gw()) could
make sure that all claims gets removed. But this function is only executed
when bat_priv->bla.claim_hash is not NULL. And since batadv_bla_free() is
always setting it to NULL before it is (indirectly) called, it was never
actually executed.

But the batadv_bla_purge_claims() -> batadv_handle_unclaim() is at the
moment too fragile because the BLA code is not handling the rehashing in
batadv_bla_update_orig_address(). The stored backbone address doesn't have
to be the one actually used for the hash bucket selection during the
initial adding of the backbone. The batadv_handle_unclaim() can therefore
fail to find the respective backbone for the unclaim and then stop the
deletion.

But the actual backbone_gw object is not needed for the unclaim because all
relevant information is always provided by the caller. And the check for
the existence of the backbone_gw doesn't provide any additional security
check for the deletion of a claim.

The Linux kernel CVE team has assigned CVE-2026-89948 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 3.5 with commit 23721387c409087fd3b97e274f34d3ddc0970b74 and fixed in 5.10.270 with commit 844a95a734f178d56c7acce14c5cce2cecff7e1a
	Issue introduced in 3.5 with commit 23721387c409087fd3b97e274f34d3ddc0970b74 and fixed in 5.15.221 with commit baeb1a28fd8e2f68193650d3664a8cd1adfd85c6
	Issue introduced in 3.5 with commit 23721387c409087fd3b97e274f34d3ddc0970b74 and fixed in 6.1.188 with commit aacffa780a37e06cd5a13d33740a6e96c3a67e6c
	Issue introduced in 3.5 with commit 23721387c409087fd3b97e274f34d3ddc0970b74 and fixed in 6.6.157 with commit 76aedcde5a2489cc971d4d1e396e784a49565e96
	Issue introduced in 3.5 with commit 23721387c409087fd3b97e274f34d3ddc0970b74 and fixed in 6.12.110 with commit f50edb69082a8ba990cc23d642089829f99afe6a
	Issue introduced in 3.5 with commit 23721387c409087fd3b97e274f34d3ddc0970b74 and fixed in 6.18.51 with commit 871acdf97f64cee8398f72b88b89e8b4f4816dbe
	Issue introduced in 3.5 with commit 23721387c409087fd3b97e274f34d3ddc0970b74 and fixed in 7.2.5 with commit 9a0c47023d3254048a1588534755d4476bcc3abc
	Issue introduced in 3.5 with commit 23721387c409087fd3b97e274f34d3ddc0970b74 and fixed in 7.3-rc1 with commit 8d128c932bced74e3b1625ba3d7c78ef122a88a7

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-89948
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	net/batman-adv/bridge_loop_avoidance.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/844a95a734f178d56c7acce14c5cce2cecff7e1a
	https://git.kernel.org/stable/c/baeb1a28fd8e2f68193650d3664a8cd1adfd85c6
	https://git.kernel.org/stable/c/aacffa780a37e06cd5a13d33740a6e96c3a67e6c
	https://git.kernel.org/stable/c/76aedcde5a2489cc971d4d1e396e784a49565e96
	https://git.kernel.org/stable/c/f50edb69082a8ba990cc23d642089829f99afe6a
	https://git.kernel.org/stable/c/871acdf97f64cee8398f72b88b89e8b4f4816dbe
	https://git.kernel.org/stable/c/9a0c47023d3254048a1588534755d4476bcc3abc
	https://git.kernel.org/stable/c/8d128c932bced74e3b1625ba3d7c78ef122a88a7