CVE-2026-52922: batman-adv: dat: handle forward allocation error

CVE-2026-52922: batman-adv: dat: handle forward allocation error

[Greg Kroah-Hartman]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

batman-adv: dat: handle forward allocation error

batadv_dat_forward_data() calls pskb_copy_for_clone() to duplicate an skb
for each DHT candidate, but does not check the return value before passing
it to batadv_send_skb_prepare_unicast_4addr(). That function dereferences
the skb unconditionally, so a failed allocation triggers a NULL pointer
dereference.

Skip forwarding to the current DHT candidate on allocation failure.

The Linux kernel CVE team has assigned CVE-2026-52922 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 3.8 with commit 785ea1144182c341b8b85b0f8180291839d176a8 and fixed in 5.10.258 with commit 9bcebaedfb8479cb4affb23c7a0d000ca9a20e73
	Issue introduced in 3.8 with commit 785ea1144182c341b8b85b0f8180291839d176a8 and fixed in 5.15.209 with commit 2edb8aeb3cdda9d00ec4997252dc5bcd6f54d8ef
	Issue introduced in 3.8 with commit 785ea1144182c341b8b85b0f8180291839d176a8 and fixed in 6.1.175 with commit ce0c381199402a2c58f4599f4f6ed100d872d0da
	Issue introduced in 3.8 with commit 785ea1144182c341b8b85b0f8180291839d176a8 and fixed in 6.6.142 with commit 866ac1d57040ed0b44ca732e3c66b3aa6b93011c
	Issue introduced in 3.8 with commit 785ea1144182c341b8b85b0f8180291839d176a8 and fixed in 6.12.92 with commit 4d420d9ee70a220a2cd95aa0dd2e15acad66a505
	Issue introduced in 3.8 with commit 785ea1144182c341b8b85b0f8180291839d176a8 and fixed in 6.18.34 with commit 9cceea8eeba710def2a5707ee00f00c74a9a1cac
	Issue introduced in 3.8 with commit 785ea1144182c341b8b85b0f8180291839d176a8 and fixed in 7.0.11 with commit cf48e75fc4fe0d5cc7721c82d454221d01367b93
	Issue introduced in 3.8 with commit 785ea1144182c341b8b85b0f8180291839d176a8 and fixed in 7.1 with commit 2d8826a2d3657cea66fb0370f9e521575a673871

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-52922
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	net/batman-adv/distributed-arp-table.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/9bcebaedfb8479cb4affb23c7a0d000ca9a20e73
	https://git.kernel.org/stable/c/2edb8aeb3cdda9d00ec4997252dc5bcd6f54d8ef
	https://git.kernel.org/stable/c/ce0c381199402a2c58f4599f4f6ed100d872d0da
	https://git.kernel.org/stable/c/866ac1d57040ed0b44ca732e3c66b3aa6b93011c
	https://git.kernel.org/stable/c/4d420d9ee70a220a2cd95aa0dd2e15acad66a505
	https://git.kernel.org/stable/c/9cceea8eeba710def2a5707ee00f00c74a9a1cac
	https://git.kernel.org/stable/c/cf48e75fc4fe0d5cc7721c82d454221d01367b93
	https://git.kernel.org/stable/c/2d8826a2d3657cea66fb0370f9e521575a673871