Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-89948— batman-adv: bla: fix freeing of claims on meshif deletion

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

以下是该 Linux 内核漏洞描述的中文翻译： 在 Linux 内核中，修复了如下漏洞： batman-adv: bla: 修复在 mesh 接口删除时释放 claims 的问题 当 mesh 接口被删除时， 函数（通过 调用）本应确保所有 claims 被移除。但该函数仅在 不为 NULL 时执行。然而，由于 在（间接地）调用之前总是将其设置为 NULL，导致该函数实际上从未被执行过。 此外， 中的 目前较为脆弱，因为 BLA 代码未处理 中的重新哈希过程。存储的骨干地址不一定是在添加骨干节点时用于选择哈希桶的地

AI Predicted 5.5 Difficulty: Hard EPSS 0.21% · P10

Possible ATT&CK Techniques 2 AI

T1527 T1527.001

Affected Version Matrix 18

VendorProduct Version RangeStatus
Linux Linux 23721387c409087fd3b97e274f34d3ddc0970b74< 844a95a734f178d56c7acce14c5cce2cecff7e1a affected
23721387c409087fd3b97e274f34d3ddc0970b74< baeb1a28fd8e2f68193650d3664a8cd1adfd85c6 affected
23721387c409087fd3b97e274f34d3ddc0970b74< aacffa780a37e06cd5a13d33740a6e96c3a67e6c affected
23721387c409087fd3b97e274f34d3ddc0970b74< 76aedcde5a2489cc971d4d1e396e784a49565e96 affected
23721387c409087fd3b97e274f34d3ddc0970b74< f50edb69082a8ba990cc23d642089829f99afe6a affected
23721387c409087fd3b97e274f34d3ddc0970b74< 871acdf97f64cee8398f72b88b89e8b4f4816dbe affected
23721387c409087fd3b97e274f34d3ddc0970b74< 9a0c47023d3254048a1588534755d4476bcc3abc affected
23721387c409087fd3b97e274f34d3ddc0970b74< 8d128c932bced74e3b1625ba3d7c78ef122a88a7 affected
… +10 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-89948

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
batman-adv: bla: fix freeing of claims on meshif deletion
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: batman-adv: bla: fix freeing of claims on meshif deletion When the mesh interface is getting deleted, then batadv_bla_del_backbone_claims() (via batadv_bla_purge_backbone_gw()) could make sure that all claims gets removed. But this function is only executed when bat_priv->bla.claim_hash is not NULL. And since batadv_bla_free() is always setting it to NULL before it is (indirectly) called, it was never actually executed. But the batadv_bla_purge_claims() -> batadv_handle_unclaim() is at the moment too fragile because the BLA code is not handling the rehashing in batadv_bla_update_orig_address(). The stored backbone address doesn't have to be the one actually used for the hash bucket selection during the initial adding of the backbone. The batadv_handle_unclaim() can therefore fail to find the respective backbone for the unclaim and then stop the deletion. But the actual backbone_gw object is not needed for the unclaim because all relevant information is always provided by the caller. And the check for the existence of the backbone_gw doesn't provide any additional security check for the deletion of a claim.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 23721387c409087fd3b97e274f34d3ddc0970b74 ~ 844a95a734f178d56c7acce14c5cce2cecff7e1a -
Linux Linux 3.5 -

II. Public POCs for CVE-2026-89948

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-89948

请登录查看更多情报信息。

Other References for CVE-2026-89948 (8)

Same Patch Batch · Linux · 2026-09-16 · 276 CVEs total

CVE-2026-90048 9.8 CRITICAL fs/ntfs3: fix slab-out-of-bounds write in ni_create_attr_list()
CVE-2026-90012 9.8 CRITICAL spi: Fix DMA mapping ownership on partial map failure
CVE-2026-89970 9.8 CRITICAL nvmet-auth: Synchronize timeout work during SQ teardown
CVE-2026-89857 9.8 CRITICAL scsi: qla2xxx: Hold qpair lock when sending NVMe LS reject
CVE-2026-89969 9.8 CRITICAL nvmet-tcp: fix out-of-bounds write when receiving an over-long PDU
CVE-2026-89847 9.8 CRITICAL scsi: qla2xxx: Avoid double completion in async IOCB timeout
CVE-2026-89972 9.8 CRITICAL nvme: add missing SRCU grace period in error path
CVE-2026-89990 9.8 CRITICAL ceph: lock mutex in ceph_mds_check_access()
CVE-2026-90036 9.8 CRITICAL NFSD: Prevent client use-after-free during blocked-lock reaping
CVE-2026-90038 9.8 CRITICAL NFSD: Prevent client use-after-free during export state revocation
CVE-2026-90037 9.8 CRITICAL NFSD: Prevent client use-after-free during close_lru reaping
CVE-2026-89788 9.8 CRITICAL ksmbd: fix tree connection use-after-free in smb2_tree_connect()
CVE-2026-89783 9.8 CRITICAL xfrm6: fix out-of-bounds write in xfrm6_input_addr() when secpath is full
CVE-2026-90042 9.8 CRITICAL ceph: properly decrypt filenames in vmalloc() buffers
CVE-2026-89778 9.8 CRITICAL isofs: fix out-of-bounds page array access on empty zisofs block
CVE-2026-89915 9.3 CRITICAL KVM: arm64: Remove VM-wide VNCR mapping counter
CVE-2026-90049 9.3 CRITICAL net: skbuff: don't skb_tx_error() the source skb in skb_zerocopy()
CVE-2026-89775 9.3 CRITICAL KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation
CVE-2026-89916 9.3 CRITICAL KVM: arm64: Make VNCR invalidation participate in MMU invalidation retry
CVE-2026-89930 9.3 CRITICAL KVM: nVMX: Service local TLB flushes on failed nested VM-Enter

Showing top 20 of 276 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-89948

No comments yet

Leave a comment