SB2026072102 - Missing Release of Resource after Effective Lifetime in Linux kernel batman-adv

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026072102

SB2026072102 - Missing Release of Resource after Effective Lifetime in Linux kernel batman-adv

Published: July 21, 2026

Security Bulletin ID SB2026072102
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Local access
Highest impact Denial of service

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-63835)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in batadv_v_ogm_queue_on_if() and the OGM aggregation queue handling when processing OGM aggregation on a disabled hard interface. A local user can trigger interface disablement while causing new skbs to be queued to the aggregation list to cause a denial of service.

The issue can lead to skbs being queued after the worker has been disabled, and these queued skbs are never freed or consumed.


Remediation

Install update from vendor's website.

References