CVE-2026-52916

kernel: batman-adv: frag: disallow unicast fragment in fragment

Loading…

Severity

Unknown

Red Hat Product Security

—

CVSS

Review impact separately from score.

Published · June 24, 2026

Updated · June 28, 2026

Description

A flaw was found in the Linux kernel's batman-adv module. A remote attacker can exploit this vulnerability by sending specially crafted BATADV_UNICAST_FRAG packets, which are designed to contain other fragmented packets. This 'fragments in fragments' scenario causes the kernel to recursively process the packets without bound, leading to kernel stack exhaustion and ultimately a Denial of Service (DoS) for the affected system.

Mitigation

No mitigation is specified in collected source.

CVSS / CWE

CWE-770 · Allocation of Resources Without Limits or Throttling