CVE Intelligence
Analysis AI-assisted

CVE-2026-52914: Linux Kernel batman-adv Fragment Reassembly Length Accounting Flaw

CVE-2026-52914 affects the batman-adv module of the Linux kernel, where the accumulated payload length of queued fragments can be truncated during updates. According to the record, this can let malformed fragment chains bypass validation and cause a local denial of service, and the record assigns a CVSS 3.1 base score of 9.8 with CWE-787. No confirmed exploitation appears in the sources consulted, and the kernel stable commits listed in the record are the primary remediation path.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-52914 is a flaw in the batman-adv module of the Linux kernel. According to the record, batman-adv keeps a running payload length for queued fragments and uses it to validate a fragment chain before reassembly. The accounting can truncate the accumulated length during updates, which the record says allows malformed fragment chains to bypass the intended validation.

Impact

The record describes the result as a local denial of service, caused by reassembly running with inconsistent length state. The record assigns CWE-787 (Out-of-bounds Write) and a CVSS 3.1 base score of 9.8 with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which describes a network attack vector with high impact on confidentiality, integrity and availability.

The description (local denial of service) and the vector (network attack vector, high confidentiality and integrity impact) are not consistent with each other, and the consulted sources do not explain the difference. Defenders should not rely on either alone when assessing exposure.

Affected products and versions

The record lists the product Linux Linux Kernel with the following ranges:

  • ≥ 3.13 and < 5.10.258
  • ≥ 5.11 and < 5.15.209
  • ≥ 5.16 and < 6.1.175
  • ≥ 6.2 and < 6.6.142
  • ≥ 6.7 and < 6.12.92
  • ≥ 6.13 and < 6.18.34
  • ≥ 6.19 and < 7.0.11
  • version 7.1-rc1
  • version 7.1-rc2
  • version 7.1-rc3
  • version 7.1-rc4

The record does not state a separate fixed version for each branch. The upper bounds of the ranges suggest the corrected versions in each series, but this is an inference. The patches listed in the record are commits in the stable kernel tree, linked in the references below: commit 37be618, commit 3eb8bcb, commit 975563c, commit 9cd3f16, commit e4f3f6b, commit e910dbf, commit f653b04 and commit fdb2c96.

Exploitation status

The CISA KEV catalog entry in the record is not listed, and no KEV dates or vendor data are present. The EPSS value is absent. No confirmed exploitation appears in the sources consulted. This analysis does not state that active exploitation is occurring.

Remediation and mitigation

  • Identify systems running Linux kernels within the affected ranges, including distribution kernels that backport fixes.
  • Apply the stable kernel updates that contain the referenced commits, or move to a kernel release outside the listed ranges, following your distribution vendor's guidance.
  • Where batman-adv is not required, consider disabling or unloading the module as a temporary measure. This is an inference from the description, not a step stated in the record.
  • Prioritize systems where untrusted or adjacent network traffic can reach the mesh networking layer, given the CVSS vector in the record.

Detection guidance

  • Inventory kernel versions and whether the batman-adv module is present or loaded on each host.
  • Review kernel logs for crashes, oopses or warnings in the batman-adv code path, which may indicate abnormal reassembly behavior.
  • Monitor for unexplained restarts or loss of mesh connectivity on nodes that rely on batman-adv.

Limitations of the available information

  • The record does not include a title, so the title in this analysis is a derived description.
  • The record provides only one CVSS source and no EPSS data.
  • The description and the CVSS vector differ on attack vector and impact scope, and the sources consulted do not resolve this.
  • The record does not include proof-of-concept details, exploit status beyond the KEV field, or distribution-specific fixed package versions.

Frequently asked questions

Is CVE-2026-52914 being actively exploited?

The record shows the CVE is not listed in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted. Treat this as no confirmed exploitation so far, not as proof that exploitation never occurs.

Which Linux kernel versions are affected?

The record lists ranges from 3.13 up to but excluding 5.10.258, 5.11 up to but excluding 5.15.209, and several other series up to 7.0.11, plus 7.1-rc1 through 7.1-rc4. Check your distribution's advisories for backported fixes.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.