The batadv_frag_send_packet function in the Linux kernel is expected to consume every skb passed to it, but a pre‑check for an empty payload or a zero fragment size returns an error without executing the function’s standard error handling path. This oversight allows a packet to be freed prematurely, resulting in a use‑after‑free condition that can corrupt kernel memory or trigger a crash. If an attacker can direct malformed traffic into the batman‑adv fragmentation routine, the flaw may provide a path to kernel compromise or privilege escalation. The vulnerability directly affects the batman‑adv networking module and is classified as a memory corruption weakness.

This issue applies to the Linux kernel, specifically the batman‑adv mesh networking module. No particular kernel version is cited in the CNA data, so any distribution that includes the affected batman‑adv release is potentially vulnerable. Systems using an unmodified or outdated kernel build with batman‑adv present should verify that the fix has been incorporated.

The CVSS score of 5.5 indicates moderate severity, while the EPSS score of less than 1% suggests a very low probability of widespread exploitation at present. The flaw is not listed in the CISA KEV catalog. The most likely attack vector is the injection of crafted network packets that trigger the mis‑handled fragmentation path on the targeted system or on a device acting as a batman‑adv relay. Successful exploitation could lead to kernel memory corruption, crashes, or arbitrary code execution, depending on the attacker’s level of control over the target environment.