LiveActive security incident?Get immediate response
CVE Record

CVE-2025-21781: batman-adv: fix panic during interface removal

In the Linux kernel, the following vulnerability has been resolved: batman-adv: fix panic during interface removal Reference counting is used to ensure that batadv_hardif_neigh_node and batadv_hard_iface are not freed before/during batadv_v_elp_throughput_metric_update work is finished. But there isn't a guarantee that the hard if will remain associated with a soft interface up until the work is finished. This fixes a crash triggered by reboot that looks like this: Call trace: batadv_v_mesh_free+0xd0/0x4dc [batman_adv] batadv_v_elp_throughput_metric_update+0x1c/0xa4 process_one_work+0x178/0x398 worker_thread+0x2e8/0x4d0 kthread+0xd8/0xdc ret_from_fork+0x10/0x20 (the batadv_v_mesh_free call is misleading, and does not actually happen) I was able to make the issue happen more reliably by changing hardif_neigh->bat_v.metric_work work to be delayed work. This allowed me to track down and confirm the fix. [sven@narfation.org: prevent entering batadv_v_elp_get_throughput without soft_iface]

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2025-21781 is a Linux kernel batman-adv flaw that can crash the kernel during interface removal, including reboot scenarios. Business impact is primarily availability: affected systems using batman-adv could panic instead of shutting down or reconfiguring cleanly.

Executive priority

Treat as a targeted availability risk, not a broad internet-facing emergency based on current evidence. Patch in normal kernel maintenance cycles, faster where batman-adv is operationally important.

Technical view

The issue is in batman-adv reference and association handling. Reference counts protect hard interface neighbor objects, but the hard interface may no longer be associated with a soft interface when throughput metric work runs, leading to a kernel panic. The upstream fix prevents entering the throughput path without a soft interface.

Likely exposure

Exposure is likely limited to Linux systems with the batman-adv module or mesh networking functionality in use. Exact exposure depends on kernel build, loaded modules, and downstream vendor package status.

Exploitation context

The source describes a crash triggered by reboot and made more reliable during testing. It does not show public exploit use, and KEV status is false, so active exploitation is not evidenced here.

Researcher notes

Evidence is incomplete for CVSS, CWE, and exploitability beyond the documented crash. Focus validation on batman-adv presence, interface teardown paths, and whether the upstream stable fixes are present in downstream kernels.

Mitigation direction

  • Update to a vendor kernel containing the referenced stable fixes.
  • Review Debian LTS advisories if using affected Debian packages.
  • Check distribution security guidance for exact fixed package versions.
  • Prioritize systems using batman-adv or mesh networking features.

Validation and detection

  • Inventory hosts with batman-adv enabled or loaded.
  • Map running kernel versions to vendor fixed package advisories.
  • Review logs for kernel panics during reboot or interface removal.
  • Confirm patched kernels include the referenced stable commits.
Prepared
Confidence
medium
Sources
12

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-21781 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
1ADP providers
11Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CVECVE Program Container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxc833484e5f3872a38fe232c663586069d5ad9645, c833484e5f3872a38fe232c663586069d5ad9645, c833484e5f3872a38fe232c663586069d5ad9645, c833484e5f3872a38fe232c663586069d5ad9645, c833484e5f3872a38fe232c663586069d5ad9645, c833484e5f3872a38fe232c663586069d5ad9645, c833484e5f3872a38fe232c663586069d5ad9645, c833484e5f3872a38fe232c663586069d5ad9645unaffected
LinuxLinux4.6, 0, 5.4.291, 5.10.235, 5.15.179, 6.1.129, 6.6.79, 6.12.16, 6.13.4, 6.14affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.