In the Linux kernel, the following vulnerability has been resolved:
net: batman-adv: fix error handling
Syzbot reported ODEBUG warning in batadv_nc_mesh_free(). The problem was
in wrong error handling in batadv_mesh_init().
Before this patch batadv_mesh_init() was calling batadv_mesh_free() in case
of any batadv_*_init() calls failure. This approach may work well, when
there is some kind of indicator, which can tell which parts of batadv are
initialized; but there isn't any.
All written above lead to cleaning up uninitialized fields. Even if we hide
ODEBUG warning by initializing bat_priv->nc.work, syzbot was able to hit
GPF in batadv_nc_purge_paths(), because hash pointer in still NULL. [1]
To fix these bugs we can unwind batadv_*_init() calls one by one.
It is good approach for 2 reasons: 1) It fixes bugs on error handling
path 2) It improves the performance, since we won't call unneeded
batadv_*_free() functions.
So, this patch makes all batadv_*_init() clean up all allocated memory
before returning with an error to no call correspoing batadv_*_free()
and open-codes batadv_mesh_free() with proper order to avoid touching
uninitialized fields.
Security readout for executives and security teams
Plain-English summary
This Linux kernel flaw affects batman-adv mesh networking error handling. Under specific failure conditions, cleanup code can touch uninitialized kernel fields, causing warnings or crashes. The business impact is mainly availability, not data theft or tampering, and exposure is limited to affected kernels where this component is present or reachable.
Executive priority
Treat this as a moderate availability risk. It is not supported as actively exploited by the provided evidence, but kernel crashes can disrupt services, so patch affected Linux systems through normal vulnerability maintenance with priority for batman-adv users.
Technical view
CVE-2021-47482 fixes incorrect unwind logic in batadv_mesh_init(). Earlier error paths called batadv_mesh_free() without tracking which batman-adv subsystems were initialized, allowing cleanup of uninitialized structures and possible general protection faults. The kernel fix unwinds initialization step by step and avoids calling free routines for uninitialized state.
Likely exposure
Linux systems running affected kernel versions with batman-adv available, enabled, or otherwise reachable are the likely exposure. Generic Linux hosts that do not load or use this mesh networking component may have materially lower practical exposure.
Exploitation context
The CVE is not listed as KEV in the provided bundle. The CVSS vector indicates network attack surface, high attack complexity, low privileges required, no user interaction, and high availability impact only. The provided sources do not establish active exploitation.
Researcher notes
Evidence is centered on a syzbot-reported kernel error path and stable kernel commits. The sources identify cleanup of uninitialized batman-adv fields as the bug class. They do not provide proof of exploitation in the wild or a product-specific mitigation beyond applying kernel fixes.
Mitigation direction
Update affected Linux kernels to vendor-supported versions containing the referenced stable fixes.
Prioritize systems where batman-adv is enabled, loaded, or used for mesh networking.
Track distribution security advisories for backported fixes matching this CVE.
Reboot systems after kernel updates where required by the vendor package process.
If patch timing is unclear, request vendor guidance for interim exposure reduction.
Validation and detection
Inventory running kernel versions across Linux assets.
Check whether batman-adv is built, loadable, loaded, or operationally required.
Confirm the installed kernel includes the relevant stable fix or vendor backport.
Review kernel logs for batman-adv ODEBUG warnings or general protection faults.
Document any exposed systems awaiting maintenance windows or vendor fixes.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Potential ATT&CK relevance
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
cwe · low confidence lookup
CWE-544: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
CWE-544 · source CWE mapping
Missing Standardized Error Handling Mechanism
Missing Standardized Error Handling Mechanism represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.