A null pointer dereference in the batman‑adv networking module of the Linux kernel can cause a kernel panic when a network interface is dropped while it is serving as the primary interface of a mesh network. The vulnerability arises because the code fails to check that the reference to the mesh interface remains valid before using it to send an ARP request. This flaw is a classic null pointer dereference (CWE‑476) and results in an abrupt system halt.

All Linux kernel installations that include the batman‑adv subsystem and have not yet received the patch committed in 2026 are affected. The commit that fixes the issue is referenced by the URLs in the advisory, but no specific kernel release version is listed; any kernel containing the vulnerable code before the patch is susceptible.

The EPSS score is reported as <1 % and the flaw is not listed in the CISA KEV catalog, indicating a low probability of widespread exploitation. Based on the description, triggering the race condition would require the ability to drop or otherwise manipulate network interfaces, a capability that typically requires local privileged access. Thus, the threat is primarily local; the impact is severe (kernel crash), but the overall risk to a non‑privileged user or remote attacker remains low.