In the batman‑adv networking driver for the Linux kernel, the formula used to update the congestion window contains an arithmetic operation that can overflow when the congestion window reaches its maximum bound of 0x20000000. The calculation casts the product of the maximum segment size and eight to 32‑bit unsigned arithmetic, causing the intermediate value to wrap to zero and producing a division by zero. This invalid operation triggers a kernel panic, resulting in denial of service for all processes that depend on the kernel’s networking stack. The flaw is a classic example of a divide‑by‑zero error (CWE‑369).

Any Linux kernel that includes the batman‑adv module is susceptible until the bug is fixed. This covers most distributions that ship with batman‑adv enabled in the stock kernel as well as custom kernels that compile the module. Systems that have the module disabled or removed are not affected.

The EPSS score is below 1 % and the vulnerability is not listed in the CISA KEV catalog, indicating a low current exploitation probability. Based on the description, it is inferred that an attacker who can send crafted TP packets through a host that has batman‑adv enabled could pressure the congestion window to its upper bound, triggering the overflow. Successful exploitation would crash the kernel, forcing a reboot and causing a denial of service. The attack requires network access to the affected host and sufficient traffic to manipulate the congestion window, so while not trivial, the exploit path is plausible in a compromised or poorly isolated network environment.