GHSA-9M5R-CR5M-2HHR
Vulnerability from github – Published: 2026-09-16 12:30 – Updated: 2026-09-16 12:30In the Linux kernel, the following vulnerability has been resolved:
batman-adv: bla: fix freeing of claims on meshif deletion
When the mesh interface is getting deleted, then batadv_bla_del_backbone_claims() (via batadv_bla_purge_backbone_gw()) could make sure that all claims gets removed. But this function is only executed when bat_priv->bla.claim_hash is not NULL. And since batadv_bla_free() is always setting it to NULL before it is (indirectly) called, it was never actually executed.
But the batadv_bla_purge_claims() -> batadv_handle_unclaim() is at the moment too fragile because the BLA code is not handling the rehashing in batadv_bla_update_orig_address(). The stored backbone address doesn't have to be the one actually used for the hash bucket selection during the initial adding of the backbone. The batadv_handle_unclaim() can therefore fail to find the respective backbone for the unclaim and then stop the deletion.
But the actual backbone_gw object is not needed for the unclaim because all relevant information is always provided by the caller. And the check for the existence of the backbone_gw doesn't provide any additional security check for the deletion of a claim.
{
"affected": [],
"aliases": [
"CVE-2026-89948"
],
"database_specific": {
"cwe_ids": [],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-16T11:17:04Z",
"severity": null
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nbatman-adv: bla: fix freeing of claims on meshif deletion\n\nWhen the mesh interface is getting deleted, then\nbatadv_bla_del_backbone_claims() (via batadv_bla_purge_backbone_gw()) could\nmake sure that all claims gets removed. But this function is only executed\nwhen bat_priv-\u003ebla.claim_hash is not NULL. And since batadv_bla_free() is\nalways setting it to NULL before it is (indirectly) called, it was never\nactually executed.\n\nBut the batadv_bla_purge_claims() -\u003e batadv_handle_unclaim() is at the\nmoment too fragile because the BLA code is not handling the rehashing in\nbatadv_bla_update_orig_address(). The stored backbone address doesn\u0027t have\nto be the one actually used for the hash bucket selection during the\ninitial adding of the backbone. The batadv_handle_unclaim() can therefore\nfail to find the respective backbone for the unclaim and then stop the\ndeletion.\n\nBut the actual backbone_gw object is not needed for the unclaim because all\nrelevant information is always provided by the caller. And the check for\nthe existence of the backbone_gw doesn\u0027t provide any additional security\ncheck for the deletion of a claim.",
"id": "GHSA-9m5r-cr5m-2hhr",
"modified": "2026-09-16T12:30:42Z",
"published": "2026-09-16T12:30:42Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-89948"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/76aedcde5a2489cc971d4d1e396e784a49565e96"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/844a95a734f178d56c7acce14c5cce2cecff7e1a"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/871acdf97f64cee8398f72b88b89e8b4f4816dbe"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/8d128c932bced74e3b1625ba3d7c78ef122a88a7"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/9a0c47023d3254048a1588534755d4476bcc3abc"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/aacffa780a37e06cd5a13d33740a6e96c3a67e6c"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/baeb1a28fd8e2f68193650d3664a8cd1adfd85c6"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/f50edb69082a8ba990cc23d642089829f99afe6a"
}
],
"schema_version": "1.4.0",
"severity": []
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.