The vulnerability arises when a batman-adv mesh interface fails to register, causing an untagged batadv_meshif_vlan structure to remain allocated. Because the .dellink path is not invoked during the abort, the object is never freed, leading to a memory leak. Repeated registration failures could accumulate these objects until system memory is exhausted, resulting in degraded performance or a crash. The weakness is a resource leak, tied to improper cleanup of private data.

The flaw affects the Linux kernel, specifically any build that includes batman-adv mesh support. All Linux distributions that ship with the unpatched kernel are potentially susceptible, regardless of vendor.

The CVSS score is 5.5, the EPSS score is < 1%, and the vulnerability is not listed in CISA’s KEV catalog. Thus the public risk profile is low to moderate, but the attack requires the ability to create batman-adv mesh interfaces, implying a local or privileged user context. An attacker with such access could trigger repeated failures to exhaust memory, but the lack of remote exploitation paths limits its danger at this time.