CVE-2024-35982: batman-adv: Avoid infinite loop trying to resize local TT
In the Linux kernel, the following vulnerability has been resolved:
batman-adv: Avoid infinite loop trying to resize local TT
If the MTU of one of an attached interface becomes too small to transmit
the local translation table then it must be resized to fit inside all
fragments (when enabled) or a single packet.
But if the MTU becomes too low to transmit even the header + the VLAN
specific part then the resizing of the local TT will never succeed. This
can for example happen when the usable space is 110 bytes and 11 VLANs are
on top of batman-adv. In this case, at least 116 byte would be needed.
There will just be an endless spam of
batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (110)
in the log but the function will never finish. Problem here is that the
timeout will be halved all the time and will then stagnate at 0 and
therefore never be able to reduce the table even more.
There are other scenarios possible with a similar result. The number of
BATADV_TT_CLIENT_NOPURGE entries in the local TT can for example be too
high to fit inside a packet. Such a scenario can therefore happen also with
only a single VLAN + 7 non-purgable addresses - requiring at least 120
bytes.
While this should be handled proactively when:
* interface with too low MTU is added
* VLAN is added
* non-purgeable local mac is added
* MTU of an attached interface is reduced
* fragmentation setting gets disabled (which most likely requires dropping
attached interfaces)
not all of these scenarios can be prevented because batman-adv is only
consuming events without the the possibility to prevent these actions
(non-purgable MAC address added, MTU of an attached interface is reduced).
It is therefore necessary to also make sure that the code is able to handle
also the situations when there were already incompatible system
configuration are present.
Security readout for executives and security teams
Plain-English summary
This Linux kernel issue can make batman-adv mesh networking code loop indefinitely when local translation-table data cannot fit within a very small effective MTU. The main business impact is availability: affected systems may become noisy, stuck, or degraded when exposed to incompatible batman-adv interface, VLAN, or MAC configuration.
Executive priority
Schedule remediation with normal availability-risk patching unless batman-adv is used in critical networking paths. For mesh-network appliances or operational networks, raise priority because the failure mode can disrupt service and produce persistent kernel log noise.
Technical view
CVE-2024-35982 is CWE-835 in batman-adv local translation-table resizing. When MTU, VLAN, fragmentation, or non-purgable entry conditions make the table impossible to fit, timeout reduction can stagnate at zero and the resize path never completes. CVSS is 5.1 with local, high-complexity availability impact only.
Likely exposure
Exposure is most likely on Linux systems using the batman-adv kernel module for mesh networking. General servers without batman-adv enabled are unlikely to be practically exposed. The CVE source lists Linux as affected across multiple kernel versions and references stable kernel fixes plus Debian LTS advisories.
Exploitation context
The source bundle does not show KEV listing or active exploitation. The described trigger depends on specific local network-interface conditions, such as very low MTU, multiple VLANs, fragmentation changes, or too many non-purgable local entries. Treat this as a denial-of-service risk, not a confidentiality or integrity issue.
Researcher notes
Do not generalize this to all Linux deployments. Focus validation on batman-adv usage and incompatible configuration states. The source bundle provides the kernel root cause and stable references, but product-level exposure should be confirmed through each vendor advisory.
Mitigation direction
Apply vendor or distribution kernel updates containing the referenced batman-adv fix.
Prioritize systems where batman-adv is loaded or mesh networking is operationally required.
Avoid unsupported low-MTU and excessive VLAN configurations on batman-adv interfaces.
Review Debian, Siemens, or platform vendor advisories for product-specific update guidance.
Monitor kernel logs for repeated batman-adv local translation-table purge messages.
Validation and detection
Inventory kernels and identify hosts with the batman-adv module enabled or loaded.
Check package or kernel changelogs for CVE-2024-35982 or referenced stable commits.
Review batman-adv interface MTU, VLAN, fragmentation, and local entry configuration.
Search system logs for repeated forced local TT purge messages.
Confirm vendor advisory status before marking embedded or appliance exposure remediated.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Potential ATT&CK relevance
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
cwe · low confidence lookup
CWE-835: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.