Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-89951— batman-adv: fix stale receive device on merged fragments

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Linux 内核中，以下漏洞已得到修复： batman-adv：修复合并分片上的陈旧接收设备问题 在分片重组过程中，系统会复用编号最大的已缓冲分片对应的 skb（套接字缓冲区）作为合并后的数据包。如果该分片是在某个硬接口（hard interface）上接收的，而该接口在分片链完成之前已被删除，那么合并后的 skb 可能会带着陈旧的 和 重新进入接收路径。 函数会再次将此类合并后的数据包通过常规的接收处理程序进行处理。DAT（动态地址表）和桥接环路避免机制都会根据 推导 ARP 头部的长度，因此在数据包到达本地

CVSS 8.8 · High EPSS 0.41% · P34

Possible ATT&CK Techniques 1 AI

T1001 · Data Obfuscation

Affected Version Matrix 18

VendorProduct Version RangeStatus
Linux Linux 610bfc6bc99bc83680d190ebc69359a05fc7f605< 63d86250fa7cbe22451369bd1c0881dfc8190958 affected
610bfc6bc99bc83680d190ebc69359a05fc7f605< f830c2dfc1431764db9256b3d5db1695fc9a7f56 affected
610bfc6bc99bc83680d190ebc69359a05fc7f605< f4b4ae763b5d59319fad62a00c76676758e7dafa affected
610bfc6bc99bc83680d190ebc69359a05fc7f605< 6df64825f8b199921120c685af2abca14b077331 affected
610bfc6bc99bc83680d190ebc69359a05fc7f605< a2c272da99c2077088083c14961cf2f1e4506995 affected
610bfc6bc99bc83680d190ebc69359a05fc7f605< e91d2cc7441d89a45bad73ad9789159c7441cb80 affected
610bfc6bc99bc83680d190ebc69359a05fc7f605< 2dffc8c44b6e3347b3719c6419c07b4a18fea895 affected
610bfc6bc99bc83680d190ebc69359a05fc7f605< ad46c907d7d9975a285c1e89a4adde652eaa93f5 affected
… +10 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-89951

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
batman-adv: fix stale receive device on merged fragments
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: batman-adv: fix stale receive device on merged fragments Fragment reassembly reuses the skb from the highest-numbered buffered fragment as the merged packet. When that fragment was received on a hard interface which is deleted before the chain completes, the merged skb can re-enter the receive path with a stale skb->dev and skb_iif. batadv_batman_skb_recv() passes such merged packets through the normal receive handlers again. DAT and bridge loop avoidance both derive the ARP header length from skb->dev, so they can dereference the freed net_device before the packet reaches the local mesh interface. Refresh the receive device metadata from the current receive device before running the packet handlers. This keeps internally reinjected merged fragments consistent with the normal receive path after hard interface teardown.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 610bfc6bc99bc83680d190ebc69359a05fc7f605 ~ 63d86250fa7cbe22451369bd1c0881dfc8190958 -
Linux Linux 3.13 -

II. Public POCs for CVE-2026-89951

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-89951

请登录查看更多情报信息。

Other References for CVE-2026-89951 (8)

Same Patch Batch · Linux · 2026-09-16 · 276 CVEs total

CVE-2026-90048 9.8 CRITICAL fs/ntfs3: fix slab-out-of-bounds write in ni_create_attr_list()
CVE-2026-90012 9.8 CRITICAL spi: Fix DMA mapping ownership on partial map failure
CVE-2026-89970 9.8 CRITICAL nvmet-auth: Synchronize timeout work during SQ teardown
CVE-2026-89857 9.8 CRITICAL scsi: qla2xxx: Hold qpair lock when sending NVMe LS reject
CVE-2026-89969 9.8 CRITICAL nvmet-tcp: fix out-of-bounds write when receiving an over-long PDU
CVE-2026-89847 9.8 CRITICAL scsi: qla2xxx: Avoid double completion in async IOCB timeout
CVE-2026-89972 9.8 CRITICAL nvme: add missing SRCU grace period in error path
CVE-2026-89990 9.8 CRITICAL ceph: lock mutex in ceph_mds_check_access()
CVE-2026-90036 9.8 CRITICAL NFSD: Prevent client use-after-free during blocked-lock reaping
CVE-2026-90038 9.8 CRITICAL NFSD: Prevent client use-after-free during export state revocation
CVE-2026-90037 9.8 CRITICAL NFSD: Prevent client use-after-free during close_lru reaping
CVE-2026-89788 9.8 CRITICAL ksmbd: fix tree connection use-after-free in smb2_tree_connect()
CVE-2026-89783 9.8 CRITICAL xfrm6: fix out-of-bounds write in xfrm6_input_addr() when secpath is full
CVE-2026-90042 9.8 CRITICAL ceph: properly decrypt filenames in vmalloc() buffers
CVE-2026-89778 9.8 CRITICAL isofs: fix out-of-bounds page array access on empty zisofs block
CVE-2026-89914 9.3 CRITICAL KVM: arm64: Sign-extend VA for range-based TLBI invalidation
CVE-2026-90049 9.3 CRITICAL net: skbuff: don't skb_tx_error() the source skb in skb_zerocopy()
CVE-2026-89775 9.3 CRITICAL KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation
CVE-2026-89916 9.3 CRITICAL KVM: arm64: Make VNCR invalidation participate in MMU invalidation retry
CVE-2026-89930 9.3 CRITICAL KVM: nVMX: Service local TLB flushes on failed nested VM-Enter

Showing top 20 of 276 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-89951

No comments yet

Leave a comment