VULN/vuln-cve
1
0 Fork 0
Code Pull Requests Actions Activity
Files
c1444140e59c61ba154436ea0cd6284d8a97c3f0
vuln-cve/data/2026/46xxx/CVE-2026-46208.json
T

270 lines
14 KiB
JSON
Raw Blame History

{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-46208",
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"state": "PUBLISHED",
"assignerShortName": "Linux",
"dateReserved": "2026-05-13T15:03:33.105Z",
"datePublished": "2026-05-28T09:40:26.341Z",
"dateUpdated": "2026-08-05T12:30:29.443Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux",
"dateUpdated": "2026-08-05T12:30:29.443Z"
},
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbatman-adv: stop tp_meter sessions during mesh teardown\n\nTP meter sessions remain linked on bat_priv->tp_list after the netlink\nrequest has already finished. When the mesh interface is removed,\nbatadv_mesh_free() currently tears down the mesh without first draining\nthese sessions.\n\nA running sender thread or a late incoming tp_meter packet can then keep\nprocessing against a mesh instance which is already shutting down.\nSynchronize tp_meter with the mesh lifetime by stopping all active\nsessions from batadv_mesh_free() and waiting for sender threads to exit\nbefore teardown continues."
}
],
"metrics": [
{
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 7.8,
"baseSeverity": "HIGH"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The controllable trigger is the local `BATADV_CMD_TP_METER` netlink command plus local interface teardown (rtnetlink); the \"late packet\" receiver path is not remotely controllable since the remote peer cannot drive the victim's teardown timing.\nAC:L - The attacker controls both sides of the race—starting a session with an attacker-chosen `test_length` (default 10s) keeps the sender thread/receiver timer alive, then removing the interface triggers the free—giving a large, reliably winnable window.\nPR:L - The tp_meter netlink op is `GENL_UNS_ADMIN_PERM`, i.e. CAP_NET_ADMIN checked against the netns owner's user namespace, which an unprivileged user obtains via `unshare -Urn`.\nUI:N - Both the session start and the mesh teardown are performed by the attacker; no victim interaction is required.\nS:U - The corruption stays within the kernel's own memory/security authority with no crossing of a VM, IOMMU, or sandbox boundary.\nC:H - Use-after-free on the netdev private data lets the attacker control freed-object contents and read adjacent/reallocated kernel memory.\nI:H - The freed `bat_priv` object can be reclaimed via heap spraying, yielding a write/control-flow-hijack primitive from the still-running sender thread and receiver timer.\nA:H - The use-after-free reliably causes a kernel oops/panic when the stale `bat_priv` and mesh tables are dereferenced after `free_netdev()`."
}
]
}
],
"affected": [
{
"product": "Linux",
"vendor": "Linux",
"defaultStatus": "unaffected",
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"programFiles": [
"net/batman-adv/main.c",
"net/batman-adv/tp_meter.c",
"net/batman-adv/tp_meter.h",
"net/batman-adv/types.h"
],
"versions": [
{
"version": "33a3bb4a3345bb511f9c69c913da95d4693e2a4e",
"lessThan": "5e7d0ac936354c36810e74ac3056b334ed1f4058",
"status": "affected",
"versionType": "git"
},
{
"version": "33a3bb4a3345bb511f9c69c913da95d4693e2a4e",
"lessThan": "268078acae72daa12b17b2b299701cb9924e469a",
"status": "affected",
"versionType": "git"
},
{
"version": "33a3bb4a3345bb511f9c69c913da95d4693e2a4e",
"lessThan": "58943b7ea356294749dae3e75b96c0ee292c00be",
"status": "affected",
"versionType": "git"
},
{
"version": "33a3bb4a3345bb511f9c69c913da95d4693e2a4e",
"lessThan": "79bc0eaeef2c5797317bf2da8e3159a74d62ec47",
"status": "affected",
"versionType": "git"
},
{
"version": "33a3bb4a3345bb511f9c69c913da95d4693e2a4e",
"lessThan": "26dfeee8db81354bfdade155f27f9e16510ad196",
"status": "affected",
"versionType": "git"
},
{
"version": "33a3bb4a3345bb511f9c69c913da95d4693e2a4e",
"lessThan": "03660dab86f93319178a24667f6998526dc4355d",
"status": "affected",
"versionType": "git"
},
{
"version": "33a3bb4a3345bb511f9c69c913da95d4693e2a4e",
"lessThan": "8634c1dbd73adb74d40533ebb7e914efb82e71fb",
"status": "affected",
"versionType": "git"
},
{
"version": "33a3bb4a3345bb511f9c69c913da95d4693e2a4e",
"lessThan": "3d3cf6a7314aca4df0a6dde28ce784a2a30d0166",
"status": "affected",
"versionType": "git"
}
]
},
{
"product": "Linux",
"vendor": "Linux",
"defaultStatus": "affected",
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"programFiles": [
"net/batman-adv/main.c",
"net/batman-adv/tp_meter.c",
"net/batman-adv/tp_meter.h",
"net/batman-adv/types.h"
],
"versions": [
{
"version": "4.8",
"status": "affected"
},
{
"version": "0",
"lessThan": "4.8",
"status": "unaffected",
"versionType": "semver"
},
{
"version": "5.10.259",
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"versionType": "semver"
},
{
"version": "5.15.210",
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"versionType": "semver"
},
{
"version": "6.1.176",
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"versionType": "semver"
},
{
"version": "6.6.140",
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"versionType": "semver"
},
{
"version": "6.12.90",
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"versionType": "semver"
},
{
"version": "6.18.32",
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"versionType": "semver"
},
{
"version": "7.0.9",
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"versionType": "semver"
},
{
"version": "7.1",
"lessThanOrEqual": "*",
"status": "unaffected",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.8",
"versionEndExcluding": "5.10.259"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.8",
"versionEndExcluding": "5.15.210"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.8",
"versionEndExcluding": "6.1.176"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.8",
"versionEndExcluding": "6.6.140"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.8",
"versionEndExcluding": "6.12.90"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.8",
"versionEndExcluding": "6.18.32"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.8",
"versionEndExcluding": "7.0.9"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.8",
"versionEndExcluding": "7.1"
}
]
}
]
}
],
"references": [
{
"url": "https://git.kernel.org/stable/c/5e7d0ac936354c36810e74ac3056b334ed1f4058"
},
{
"url": "https://git.kernel.org/stable/c/268078acae72daa12b17b2b299701cb9924e469a"
},
{
"url": "https://git.kernel.org/stable/c/58943b7ea356294749dae3e75b96c0ee292c00be"
},
{
"url": "https://git.kernel.org/stable/c/79bc0eaeef2c5797317bf2da8e3159a74d62ec47"
},
{
"url": "https://git.kernel.org/stable/c/26dfeee8db81354bfdade155f27f9e16510ad196"
},
{
"url": "https://git.kernel.org/stable/c/03660dab86f93319178a24667f6998526dc4355d"
},
{
"url": "https://git.kernel.org/stable/c/8634c1dbd73adb74d40533ebb7e914efb82e71fb"
},
{
"url": "https://git.kernel.org/stable/c/3d3cf6a7314aca4df0a6dde28ce784a2a30d0166"
}
],
"title": "batman-adv: stop tp_meter sessions during mesh teardown",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
}
}
View Git Blame Copy Permalink