CVE-2026-93204
kernel: batman-adv: dat: atomically update mac addresses
Severity
ModerateRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · September 17, 2026
Updated · October 14, 2026
Description
A flaw was found in the batman-adv component of the Linux kernel. When a Media Access Control (MAC) address is updated, the update is not performed atomically. This allows a parallel process to read a partially updated MAC address, which could then be used to poison the Address Resolution Protocol (ARP) cache on the network. This could lead to network disruption or misdirection of traffic.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.1 · 5.5CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-367 · Time-of-check Time-of-use (TOCTOU) Race Condition