The batman-adv bridge module has a flaw in its timer cleanup routine. During cleanup, the code calls timer_delete_sync() followed by timer_delete() to prevent the timer from being re‑armed. If the timer is re‑armed between these two calls, a use‑after‑free can occur, allowing the kernel to execute a callback on a freed timer object. This results in a kernel crash, which effectively denies service. The weakness is classified as CWE-364.

All Linux systems that load the batman-adv bridge module and contain the unpatched batadv_tp_sender_cleanup function are potentially vulnerable. The description does not specify a version range, so any kernel build that includes the buggy code—common in many distributions that ship batman-adv—is affected. The vulnerability only manifests when the module is active and a packet‑sender operation reaches the cleanup path.

The CVSS base score of 8.8 indicates a high severity. The EPSS score of <1% suggests a low current exploitation probability, and the flaw is not yet listed in CISA KEV. Exploitation would typically require an attacker capable of influencing batman‑adv traffic to trigger the sender cleanup, such as by injecting crafted packets or controlling a node in a batman‑adv network. The attack vector is network‑oriented and relies on kernel‑space execution; it is not trivially usable from a remote user without affecting the bridge or operating the kernel directly.