A use‑after‑free bug exists in the batman‑adv multicast module of the Linux kernel. The purge function releases nodes without waiting for an RCU grace period, which allows concurrent readers to dereference freed memory. This race can corrupt kernel data structures and may enable an attacker to execute arbitrary code with kernel privileges or cause a denial of service. The weakness is a classic example of CWE‑825: use after free by concurrent threads.

All Linux kernel builds that include the batman‑adv networking stack and have not yet applied the patch that moves the purge logic into the node release routine. The vulnerability is present in kernel source trees labeled "Linux", but no specific kernel or distribution version is enumerated in the data.

The CVSS score of 8.8 indicates high severity. The EPSS score is reported as < 1 %, suggesting that the probability of exploitation in the near future is very low. The vulnerability is not listed in the CISA KEV catalog, so no publicly known active exploits are confirmed. The likely attack scenario requires local code execution that can manipulate the kernel’s networking stack, for example by running code as root or within a privileged container that loads batman‑adv. Given the absence of a remote trigger, the threat is primarily for systems where an attacker can gain local kernel code execution.