CVE-2026-52931

Last refreshed2026-10-17

Status: UPDATED | Advisory ID: CVE-2026-52931

Key Details

CVE	CVE-2026-52931
CVSS Score / Version	9.8 (Critical) / CVSS v3.1
Updated	2026-10-16
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`
CVSS Prose	attack vector is network; attack complexity is low; privileges required is none; user interaction is none; scope is unchanged; confidentiality impact is high; integrity impact is high; availability impact is high.
Affected products	Linux Kernel

Vendor	Product	Affected Versions	Patch Status
Linux	Linux Kernel

Vendor

Product

Affected Versions

Patch Status

Linux

Linux Kernel

Subsystems	OT Supporting Infrastructure
Sectors	All Sectors

In the Linux kernel, the following vulnerability has been resolved:

batman-adv: tp_meter: avoid use of uninit sender vars

batadv_tp_recv_ack() and batadv_tp_stop() are only valid for tp_vars in the

BATADV_TP_SENDER role. When called with a BATADV_TP_RECEIVER role, it

proceeds to read sender-only members that were never initialized, leading

to undefined behavior.

This can be triggered when a node that is currently acting as a receiver in

an ongoing tp_meter session receives a malicious ACK packet.

Guard against this by checking tp_vars->role immediately after the

lookup and bailing out if it is not BATADV_TP_SENDER, before any of

those members are accessed. (NVD)

Monitor Linux's web page for any future patch releases.

Source	Reference
NVD	https://nvd.nist.gov/vuln/detail/CVE-2026-52931
CVE	https://www.cve.org/CVERecord?id=CVE-2026-52931

Source

Reference

NVD

CVE