Security readout for executives and security teams
Plain-English summary
A local, low-privileged user may start a batman-adv throughput-meter session while the mesh is shutting down. The supplied CVSS assessment indicates this could compromise confidentiality, integrity, and availability. Risk is concentrated on Linux systems that actively use batman-adv; ordinary systems without that feature are less likely to be exposed.
Executive priority
Prioritize prompt remediation on multi-user, edge, routing, or mesh-network systems using batman-adv. Treat other Linux assets as an inventory-validation task before emergency action. There is no supplied evidence of active exploitation, but the high CVSS impact warrants timely patching once affected systems are identified.
Technical view
The flaw allows tp_meter sender or receiver sessions to begin after batman-adv mesh_state leaves BATADV_MESH_ACTIVE. The kernel fix rejects these sessions during teardown. CVSS 3.1 is 7.8 (local access, low privileges, low complexity, no user interaction, and high impact across confidentiality, integrity, and availability). The bundle does not identify a CWE or precise failure mechanism.
Likely exposure
Likely exposure is limited to affected Linux kernels where batman-adv and tp_meter are present and usable. The supplied version data is ambiguous and includes hashes plus broad version entries, so kernel package names alone cannot reliably establish status. Distribution backports may also change exposure; confirm against vendor advisories and fixed-commit ancestry.
Exploitation context
The CVSS vector describes local, low-privileged exploitation without user interaction. The bundle does not establish remote exploitation, a public proof of concept, or observed attacks. CVE-2026-46206 is not marked as CISA KEV. Exact timing and configuration prerequisites beyond mesh teardown and tp_meter session creation are not documented here.
Researcher notes
The central invariant is that no new tp_meter sender or receiver session should start after mesh_state leaves BATADV_MESH_ACTIVE. Review the referenced stable patches for branch-specific implementation differences. The bundle does not disclose whether the underlying consequence is use-after-free, another memory-safety issue, or a logic failure, so avoid asserting a specific root cause.
Mitigation direction
- Update to a supported vendor kernel containing the applicable upstream stable fix.
- Check Linux distribution guidance for fixed package versions and backports.
- Prioritize systems actively using batman-adv mesh networking.
- Apply normal kernel-update reboot or activation procedures required by the vendor.
Validation and detection
- Inventory hosts with batman-adv loaded, configured, or available to local users.
- Record running kernel versions and distribution package revisions.
- Confirm fixed-commit inclusion through vendor advisories or kernel source ancestry.
- Verify the remediated kernel is running after update activation.
- Review local telemetry for abnormal batman-adv teardown or tp_meter activity.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2026-46206 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/0a7a840074c9ca5ebffc9c52358c8ea55828ec71CVE reference, Linux
- https://git.kernel.org/stable/c/dcff44644bb518598b1a6be722706d6174b2f6a1CVE reference, Linux
- https://git.kernel.org/stable/c/52e6ec3e972cf27792cc1559874dbee19f286869CVE reference, Linux
- https://git.kernel.org/stable/c/e4a3c4a4c8f6efd243c3e448c05b7bebcbf7b3b6CVE reference, Linux
- https://git.kernel.org/stable/c/ff93f86ecbb50a4709c403fc279a396e308edde5CVE reference, Linux
- https://git.kernel.org/stable/c/e1e2194cc725ec1d41f9412496212f0fa0519c36CVE reference, Linux
- https://git.kernel.org/stable/c/ca39545cf07c142b39d474a1439a046bf28def3dCVE reference, Linux
- https://git.kernel.org/stable/c/3243543592425beec83d453793e9d27caa0d8e66CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.