LiveActive security incident?Get immediate response
CVE Record

CVE-2026-46233: batman-adv: bla: only purge non-released claims

In the Linux kernel, the following vulnerability has been resolved: batman-adv: bla: only purge non-released claims When batadv_bla_purge_claims() goes through the list of claims, it is only traversing the hash list with an rcu_read_lock(). Due to a potential parallel batadv_claim_put(), it can happen that it encounters a claim which was actually in the process of being released+freed by batadv_claim_release(). In this case, backbone_gw is set to NULL before the delayed RCU kfree is started. Calling batadv_bla_claim_get_backbone_gw() is then no longer allowed because it would cause a NULL-ptr derefence. To avoid this, only claims with a valid reference counter must be purged. All others are already taken care of.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

CVE-2026-46233 is a Linux kernel issue in the batman-adv networking component. A race during claim cleanup can reach data that is already being released, causing a NULL pointer dereference. The public record does not provide CVSS, confirmed exploitation, or a complete operational impact statement.

Executive priority

Treat as a targeted kernel maintenance item, not an emergency from the available evidence. Prioritize patching where batman-adv is used or kernel crash tolerance is low. Reassess if vendor advisories assign severity or exploitation evidence appears.

Technical view

batadv_bla_purge_claims() traverses claim hash entries under rcu_read_lock(). A concurrent batadv_claim_put() can move a claim into release, where backbone_gw is set to NULL before delayed RCU free. Calling batadv_bla_claim_get_backbone_gw() on that claim can dereference NULL. The fix purges only claims with a valid reference counter.

Likely exposure

Exposure is most relevant to Linux systems running affected kernel versions or branches that include the vulnerable batman-adv code, especially where batman-adv is present or used. The bundle lists affected Linux versions but provides no CPEs, distribution advisories, or deployment prerequisites.

Exploitation context

The bundle says KEV is false and cites no active exploitation. No public source in the bundle describes exploit availability, attacker prerequisites, or remote trigger conditions. Based on the description, the plausible impact is kernel instability from a NULL pointer dereference, but severity is not scored.

Researcher notes

The important missing details are trigger path, attacker position, required configuration, and whether the NULL dereference is reliably reachable outside specific batman-adv BLA states. The record only supports a race condition in claim purge/release handling and stable-branch fixes.

Mitigation direction

  • Apply the relevant Linux stable fix for your maintained kernel branch.
  • Check distribution or vendor advisories for packaged kernel update guidance.
  • Prioritize systems using affected kernel branches and batman-adv networking.
  • Avoid ad hoc mitigations unless confirmed by your kernel vendor.

Validation and detection

  • Inventory Linux kernel versions against the affected version list and stable commits.
  • Check whether batman-adv is installed, loaded, or configured on candidate systems.
  • Review vendor kernel changelogs for the referenced fix commits.
  • Confirm updated kernels include the batman-adv BLA claim purge fix.
Prepared
Confidence
medium
Sources
10

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2026-46233 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
9Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux23721387c409087fd3b97e274f34d3ddc0970b74, 23721387c409087fd3b97e274f34d3ddc0970b74, 23721387c409087fd3b97e274f34d3ddc0970b74, 23721387c409087fd3b97e274f34d3ddc0970b74, 23721387c409087fd3b97e274f34d3ddc0970b74, 23721387c409087fd3b97e274f34d3ddc0970b74, 23721387c409087fd3b97e274f34d3ddc0970b74, 23721387c409087fd3b97e274f34d3ddc0970b74unaffected
LinuxLinux3.5, 0, 5.10.258, 5.15.209, 6.1.175, 6.6.140, 6.12.90, 6.18.32, 7.0.9, 7.1affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.