LiveActive security incident?Get immediate response
CVE Record

CVE-2024-35982: batman-adv: Avoid infinite loop trying to resize local TT

In the Linux kernel, the following vulnerability has been resolved: batman-adv: Avoid infinite loop trying to resize local TT If the MTU of one of an attached interface becomes too small to transmit the local translation table then it must be resized to fit inside all fragments (when enabled) or a single packet. But if the MTU becomes too low to transmit even the header + the VLAN specific part then the resizing of the local TT will never succeed. This can for example happen when the usable space is 110 bytes and 11 VLANs are on top of batman-adv. In this case, at least 116 byte would be needed. There will just be an endless spam of batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (110) in the log but the function will never finish. Problem here is that the timeout will be halved all the time and will then stagnate at 0 and therefore never be able to reduce the table even more. There are other scenarios possible with a similar result. The number of BATADV_TT_CLIENT_NOPURGE entries in the local TT can for example be too high to fit inside a packet. Such a scenario can therefore happen also with only a single VLAN + 7 non-purgable addresses - requiring at least 120 bytes. While this should be handled proactively when: * interface with too low MTU is added * VLAN is added * non-purgeable local mac is added * MTU of an attached interface is reduced * fragmentation setting gets disabled (which most likely requires dropping attached interfaces) not all of these scenarios can be prevented because batman-adv is only consuming events without the the possibility to prevent these actions (non-purgable MAC address added, MTU of an attached interface is reduced). It is therefore necessary to also make sure that the code is able to handle also the situations when there were already incompatible system configuration are present.

MediumCVSS 5.1Not KEV-listedUpdated
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

This Linux kernel issue can make batman-adv mesh networking code loop indefinitely when local translation-table data cannot fit within a very small effective MTU. The main business impact is availability: affected systems may become noisy, stuck, or degraded when exposed to incompatible batman-adv interface, VLAN, or MAC configuration.

Executive priority

Schedule remediation with normal availability-risk patching unless batman-adv is used in critical networking paths. For mesh-network appliances or operational networks, raise priority because the failure mode can disrupt service and produce persistent kernel log noise.

Technical view

CVE-2024-35982 is CWE-835 in batman-adv local translation-table resizing. When MTU, VLAN, fragmentation, or non-purgable entry conditions make the table impossible to fit, timeout reduction can stagnate at zero and the resize path never completes. CVSS is 5.1 with local, high-complexity availability impact only.

Likely exposure

Exposure is most likely on Linux systems using the batman-adv kernel module for mesh networking. General servers without batman-adv enabled are unlikely to be practically exposed. The CVE source lists Linux as affected across multiple kernel versions and references stable kernel fixes plus Debian LTS advisories.

Exploitation context

The source bundle does not show KEV listing or active exploitation. The described trigger depends on specific local network-interface conditions, such as very low MTU, multiple VLANs, fragmentation changes, or too many non-purgable local entries. Treat this as a denial-of-service risk, not a confidentiality or integrity issue.

Researcher notes

Do not generalize this to all Linux deployments. Focus validation on batman-adv usage and incompatible configuration states. The source bundle provides the kernel root cause and stable references, but product-level exposure should be confirmed through each vendor advisory.

Mitigation direction

  • Apply vendor or distribution kernel updates containing the referenced batman-adv fix.
  • Prioritize systems where batman-adv is loaded or mesh networking is operationally required.
  • Avoid unsupported low-MTU and excessive VLAN configurations on batman-adv interfaces.
  • Review Debian, Siemens, or platform vendor advisories for product-specific update guidance.
  • Monitor kernel logs for repeated batman-adv local translation-table purge messages.

Validation and detection

  • Inventory kernels and identify hosts with the batman-adv module enabled or loaded.
  • Check package or kernel changelogs for CVE-2024-35982 or referenced stable commits.
  • Review batman-adv interface MTU, VLAN, fragmentation, and local entry configuration.
  • Search system logs for repeated forced local TT purge messages.
  • Confirm vendor advisory status before marking embedded or appliance exposure remediated.
Prepared
Confidence
high
Sources
12

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · low confidence lookup

CWE-835: Exact CWE lookup

Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2024-35982 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Medium
CVSS
5.1 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
3ADP providers
12Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
5.1CVSS 3.1MediumCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H1.43.6CISA-ADP

Vulnerability scoring details

Base CVSS 3.1 score

5.1Medium
CVSS 3.1 vector shape for CVE-2024-35982Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
cvssV3_1other:ssvc
CVECVE Program Container
siemens-SADPADP container
Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxa19d3d85e1b854e4a483a55d740a42458085560d, a19d3d85e1b854e4a483a55d740a42458085560d, a19d3d85e1b854e4a483a55d740a42458085560d, a19d3d85e1b854e4a483a55d740a42458085560d, a19d3d85e1b854e4a483a55d740a42458085560d, a19d3d85e1b854e4a483a55d740a42458085560d, a19d3d85e1b854e4a483a55d740a42458085560d, a19d3d85e1b854e4a483a55d740a42458085560dunaffected
LinuxLinux3.13, 0, 4.19.313, 5.4.275, 5.10.216, 5.15.156, 6.1.87, 6.6.28, 6.8.7, 6.9affected
Weakness

CWE details

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.