Technical impact
Batman-adv is a MAC‑level virtual network overlay integrated into the Linux kernel that performs packet fragmentation and defragmentation. A flaw was discovered in the logic that processes BATADV_UNICAST_FRAG packets, allowing an attacker to nest a fragmentation packet inside the payload of another, creating an unbounded recursion. Each nesting level forces the kernel to invoke batadv_batman_skb_recv recursively, causing the kernel stack to grow until it overflows and the system crashes or reboots. The vulnerability therefore leads to a local or remote denial of service via stack exhaustion.
Affected Systems
All Linux kernel versions that include the batman‑adv overlay module prior to the commit that removed the recursion guard are affected. Known CPE entries cover generic Linux kernels and kernel 7.1 release candidates (rc1‑rc4). Thus any kernel that has not incorporated the fix is vulnerable.
Risk and Exploitability
The CVSS score of 5.5 reflects a medium severity denial‑of‑service impact, while the EPSS score of less than 1% indicates a very low probability of active exploitation. The vulnerability is not listed in CISA's KEV catalog. An attacker must be able to deliver crafted BATADV_UNICAST_FRAG packets over the network; the likely attack vector is remote connectivity to the target host, inferred from the requirement that the packet is received by batam-adv upon arrival. Exploitation requires no special privileges and involves sending a specifically constructed fragment chain that repeatedly triggers defragmentation, eventually exhausting the kernel stack.
Debian DLA
Ubuntu USN