The batman‑adv routing stack in the Linux kernel can reply to TT (Topology Tree) requests with empty VLAN identifiers when the global TT state is used. Because the kernel does not check for this condition, a node may generate a series of TT responses, creating repeated TT request storms that consume CPU, memory, and network resources, potentially degrading performance or causing a denial‑of‑service for nodes on the same mesh. The weakness is a classic resource‑exhaustion flaw, identified as CWE‑770.

Any system running a Linux kernel that includes the batman‑adv module compiled before the commit 16116dac2339 is vulnerable. This includes most recent kernel releases with batman‑adv enabled by default, as well as custom builds that incorporate the module without the patch. The problem occurs only on nodes that participate in a batman‑adv mesh network; standard host networking without batman‑adv is unaffected.

The EPSS score of less than 1% indicates that exploitation is judged to be unlikely at this time, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a local attacker who can send TT requests to a target node on the same mesh or subnet, as inferred from the nature of the vulnerability. If such an attacker succeeds, they could trigger TT request storms that exhaust processing resources and degrade network operation. No workaround is provided, so patching the kernel is the recommended response.