The vulnerability exists in the batman-adv module of the Linux kernel. The function batadv_bla_add_claim() can replace the claim-backbone_gw pointer and drop the reference to the previous gateway while another reader still holds the pointer. This results in a dangling or uninitialized reference that can be dereferenced by netlink claim dump or claim check paths. The exposed dereference can corrupt the kernel’s address space, yielding arbitrary code execution or a system crash. The weakness is identified as CWE-476 (Dereferenced Uninitialized Pointer).

Affected kernels include Linux kernel 3.5 and all 7.0 release candidates from RC1 through RC7. Any system running these kernel versions with the batman-adv driver enabled is susceptible.

The CVSS score of 9.8 highlights criticality, while the EPSS score of less than 1% indicates that, as of the latest data, active exploitation is uncommon but still possible. The vulnerability is not yet listed in the CISA KEV catalog. Exploitation likely requires local privileges or a network packet that triggers the batman-adv netlink handler, as the flaw stems from a pointer misuse rather than a public-facing interface that can be called from unprivileged users. Administrators should treat this as a high-risk zero-day.