CVE-2026-52931: Linux kernel batman-adv tp_meter uninitialized sender state flaw

Overview

CVE-2026-52931 affects the tp_meter throughput-test component of the batman-adv mesh routing module in the Linux kernel. The record describes two functions, batadv_tp_recv_ack() and batadv_tp_stop(), that are valid only when the local test state is in the sender role, yet can be reached while the state is in the receiver role and then read sender-only fields that were never set. The NVD entry lists the same record data.

Impact

• The record describes the result as undefined behavior caused by reading uninitialized sender-only members.
• According to the record, the trigger is a node acting as receiver in an ongoing tp_meter session receiving a malicious ACK packet.
• The CVSS 3.1 vector in the record (network vector, low complexity, no privileges, no user interaction, high impact to confidentiality, integrity and availability) points to a severe potential outcome. The record does not describe a specific effect such as code execution.

Affected products and versions

The record lists the Linux Linux Kernel product with these ranges:

• ≥ 4.8 and < 5.10.258
• ≥ 5.11 and < 5.15.209
• ≥ 5.16 and < 6.1.175
• ≥ 6.2 and < 6.6.142
• ≥ 6.7 and < 6.12.92
• ≥ 6.13 and < 6.18.34
• ≥ 6.19 and < 7.0.11
• 7.1-rc1, 7.1-rc2, 7.1-rc3 and 7.1-rc4

These ranges come from the assembled record. Check the stable branch used by your distribution, because vendor backports may differ.

Exploitation status

The record marks the CVE as not listed in the CISA KEV catalog. No confirmed active exploitation or exploited in the wild status appears in the sources consulted. The record contains no EPSS data.

Remediation and mitigation

• Apply the stable kernel update for your branch that includes the upstream fix. The record links eight stable commits, such as commit 0e388af0.
• If an update cannot be applied immediately, consider limiting exposure of batman-adv mesh networks to trusted nodes and reviewing whether tp_meter is in use. This is an inference from the described trigger, not a documented vendor workaround.
• After updating, verify the running kernel version and confirm that the installed kernel includes the fix for your branch.

Detection guidance

• Monitor batman-adv deployments for unusual tp_meter session activity, particularly unsolicited or malformed ACK traffic reaching nodes that act as receivers.
• Review kernel logs for crashes or warnings related to batman-adv during tp_meter operations. The record does not describe a specific log signature.

Limitations of the available information

• The record contains no CWE classification and no EPSS score.
• The record's title field is empty, so the titles here are derived from the description.
• The record does not state the required network position, exact exploitability conditions or the observable effects of the undefined behavior.
• The record does not name a fixed version per branch. The affected ranges above show where vulnerable versions end.

Frequently asked questions

What does CVE-2026-52931 affect?

According to the record, it affects the batman-adv tp_meter component of the Linux kernel within the listed version ranges, such as 6.6.142 excluded upper bounds per branch.

Is this flaw known to be actively exploited?

The record shows it is not listed in the CISA KEV catalog, and no confirmed active exploitation appears in the sources consulted.

What is the recommended response?

Apply the stable kernel update for your branch that includes the upstream fix, and verify the running kernel version after updating.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.