The batman-adv tp_meter module incorrectly treats a receiver’s incoming ACK packet as if the node were a sender, causing the code to read sender‑only fields that were never initialized. This results in undefined behaviour; the kernel can crash, corrupt memory, or behave unpredictably. The CVE data contains no explicit mention of privilege escalation or remote code execution, so the impact is limited to stability and confidentiality of the affected node.

All Linux kernels that include the batman-adv subsystem and have not applied the fix are affected. The CPE list covers the generic linux_kernel and specific releases 7.1 rc1 through rc4, so any build containing the unpatched code, especially systems participating in a tp_meter mesh network, is vulnerable.

The CVSS score of 9.8 denotes a high severity flaw. The EPSS score of <1% indicates an extremely low probability of exploitation at present, and the vulnerability is not listed in CISA KEV. An attacker would need to craft and send a malicious acknowledgment packet while the target is acting as a receiver in a tp_meter session. This requires network proximity on the mesh network or active participation in the session, making the attack scenario more specialized. If triggered, the undefined behaviour could lead to a kernel panic or data corruption, potentially forming a denial‑of‑service vector. Exploitation to gain higher privileges or execute code has not been demonstrated in the CVE data; any such outcome would stem from the ensuing memory corruption or crash.