---
id: CVE-2026-31657
title: 'batman-adv: hold claim backbone gateways by reference'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  batman-adv: hold claim backbone gateways by reference

  batadv_bla_add_claim() can replace claim->backbone_gw and drop the old
  gateway's last reference while readers sti…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 23721387c409087fd3b97e274f34d3ddc0970b74 <
    5202f071b367ffbc8e279fc7a00db14f5e587f52
  - >-
    Linux >= 23721387c409087fd3b97e274f34d3ddc0970b74 <
    69d1ce9c72eca91203ffdb8d08bacd511100aec6
  - >-
    Linux >= 23721387c409087fd3b97e274f34d3ddc0970b74 <
    f4858832ddef2f39f21e30b7226bbcd3c4b2bc96
  - >-
    Linux >= 23721387c409087fd3b97e274f34d3ddc0970b74 <
    2f55b58b5a0bbed192d60c444a45a49cdf1b545f
  - >-
    Linux >= 23721387c409087fd3b97e274f34d3ddc0970b74 <
    7962b522222628596ca9ecc8722efc95367aadbd
  - >-
    Linux >= 23721387c409087fd3b97e274f34d3ddc0970b74 <
    4dee4c0688443aaf5bbec74aa203c851d1d53c35
  - >-
    Linux >= 23721387c409087fd3b97e274f34d3ddc0970b74 <
    1f2dc36c297d27733f1b380ea644cf15a361bd7b
  - >-
    Linux >= 23721387c409087fd3b97e274f34d3ddc0970b74 <
    82d8701b2c930d0e96b0dbc9115a218d791cb0d2
  - Linux 3.5
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-10-16T15:11:37.875669Z'
published: '2026-04-24'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T15:20:19.812Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-31657'
references:
  - url: 'https://git.kernel.org/stable/c/5202f071b367ffbc8e279fc7a00db14f5e587f52'
  - url: 'https://git.kernel.org/stable/c/69d1ce9c72eca91203ffdb8d08bacd511100aec6'
  - url: 'https://git.kernel.org/stable/c/f4858832ddef2f39f21e30b7226bbcd3c4b2bc96'
  - url: 'https://git.kernel.org/stable/c/2f55b58b5a0bbed192d60c444a45a49cdf1b545f'
  - url: 'https://git.kernel.org/stable/c/7962b522222628596ca9ecc8722efc95367aadbd'
  - url: 'https://git.kernel.org/stable/c/4dee4c0688443aaf5bbec74aa203c851d1d53c35'
  - url: 'https://git.kernel.org/stable/c/1f2dc36c297d27733f1b380ea644cf15a361bd7b'
  - url: 'https://git.kernel.org/stable/c/82d8701b2c930d0e96b0dbc9115a218d791cb0d2'
tags:
  - cve.org
epss: 0.00399
epssPercentile: 0.32547
ingestedAt: '2026-10-16T17:24:46.667Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

batman-adv: hold claim backbone gateways by reference

batadv_bla_add_claim() can replace claim->backbone_gw and drop the old
gateway's last reference while readers still follow the pointer.

The netlink claim dump path dereferences claim->backbone_gw->orig and
takes claim->backbone_gw->crc_lock without pinning the underlying
backbone gateway. batadv_bla_check_claim() still has the same naked
pointer access pattern.

Reuse batadv_bla_claim_get_backbone_gw() in both readers so they operate
on a stable gateway reference until the read-side work is complete.
This keeps the dump and claim-check paths aligned with the lifetime
rules introduced for the other BLA claim readers.

## Affected

- `Linux >= 23721387c409087fd3b97e274f34d3ddc0970b74 < 5202f071b367ffbc8e279fc7a00db14f5e587f52`
- `Linux >= 23721387c409087fd3b97e274f34d3ddc0970b74 < 69d1ce9c72eca91203ffdb8d08bacd511100aec6`
- `Linux >= 23721387c409087fd3b97e274f34d3ddc0970b74 < f4858832ddef2f39f21e30b7226bbcd3c4b2bc96`
- `Linux >= 23721387c409087fd3b97e274f34d3ddc0970b74 < 2f55b58b5a0bbed192d60c444a45a49cdf1b545f`
- `Linux >= 23721387c409087fd3b97e274f34d3ddc0970b74 < 7962b522222628596ca9ecc8722efc95367aadbd`
- `Linux >= 23721387c409087fd3b97e274f34d3ddc0970b74 < 4dee4c0688443aaf5bbec74aa203c851d1d53c35`
- `Linux >= 23721387c409087fd3b97e274f34d3ddc0970b74 < 1f2dc36c297d27733f1b380ea644cf15a361bd7b`
- `Linux >= 23721387c409087fd3b97e274f34d3ddc0970b74 < 82d8701b2c930d0e96b0dbc9115a218d791cb0d2`
- `Linux 3.5`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.