The batman‑adv module includes a TOCTOU race condition in the generation of the TT‑based TVLV used for reporting VLANs. The thread counts how many VLANs have at least one TT entry, allocates a buffer of that size, and then fills the buffer while holding meshif_vlan_list_lock. A local network user can increase the number of TT entries for a VLAN during the interval between the size calculation and the buffer allocation, causing the allocation to be too small. The resulting memory corruption can be triggered with crafted packets and may lead to kernel privilege escalation or arbitrary code execution.

All Linux kernel installations that include the batman‑adv module before the patch commit (211ea59988e1cba…); no specific version information is provided in the CVE record. The vulnerability is limited to the batman‑adv component; other kernel modules are not affected. Kernel vendors that ship batman‑adv (most generic Linux distributions) must update to a version incorporating the fix.

The CVSS score of 9.8 indicates a critical rating, but the EPSS score of less than 1% shows that public exploitation is currently unlikely. The vulnerability is not listed in the CISA KEV catalog, and no public exploits are known. The attack vector is local to the node, requiring a network attacker who can send malformed or specially crafted packets to the VLAN interface that the node participates in. While the risk of local kernel privilege escalation or arbitrary code execution is high, its probability of real-world exploitation remains low with the current information.