The batman‑adv routing stack in the Linux kernel can reply to TT (Topology Tree) requests with empty VLAN identifiers when the global TT state is used. Because the kernel does not check for this condition, a node may generate a series of TT responses, creating repeated TT request storms that consume CPU, memory, and network resources, potentially degrading performance or causing a denial‑of‑service for nodes on the same mesh. The weakness is a classic resource‑exhaustion flaw, identified as CWE‑770.

Linux kernel builds including the batman‑adv module compiled before commit 16116dac2339 are affected, covering the default module in most recent kernel releases as well as for custom builds that incorporate batman‑adv without the patch. The issue manifests only on nodes that participate in a batman‑adv mesh network; standard host networking without batman‑adv is unaffected.

The CVSS score of 5.5 indicates moderate severity, while the EPSS score of less than 1% suggests that exploitation is judged unlikely at this time. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a local attacker who can send TT requests to a target node on the same mesh or subnet, as inferred from the nature of the vulnerability. If such an attacker succeeds, they could trigger TT request storms that exhaust processing resources and degrade network operation. No workaround is provided, so patching the kernel is the recommended response.