A counter underflow occurs in the batman‑adv tap meter shutdown routine. The atomic counter is decremented unconditionally; if multiple shutdown paths are activated the counter can become negative. Because the sender logic interprets any non‑zero value as "still sending", a negative counter causes the sender kernel thread to loop indefinitely. When the underlying network interface is removed while the zombie thread remains active, a use‑after‑free occurs, potentially crashing the kernel and providing a denial‑of‑service vector. The weakness involves improper counter management and resource deallocation.

All Linux kernel releases that include batman‑adv and employ the tp_meter implementation are affected. No specific version range is provided in the CVE entry, so the vulnerability applies to any kernel revision that has not yet integrated the fix contained in commits linked in the references.

The CVSS score is not listed, and the EPSS score is unavailable, making it difficult to quantify severity. The vulnerability is listed as not being in the CISA KEV catalog, suggesting it is not known to be actively exploited. However, a use‑after‑free in kernel code is a high‑impact flaw; exploitation would likely require local control over batman‑adv traffic or the ability to trigger multiple shutdown paths. Inferred from the description, the attack vector appears to be local or through manipulation of batman‑adv control packets. The risk remains significant for systems that run batman‑adv services without the patch.