CVE-2026-89950

In the Linux kernel, the following vulnerability has been resolved: batman-adv: mcast: linearize skbuff for packet generation batadv_mcast_forw_packet() and batadv_mcast_forw_scrape() is not only called (indirectly) by the unsharing+linearizing batadv_recv_mcast_packet() handler. When it is called (indirectly) by batadv_mcast_forw_mcsend() then it will be unshared but not linearized. The SKB_LINEAR_ASSERT() can therefore cause a fatal BUG(). The linearization should happen during the expansion of the head because the scrape function can be hit already during the initial batadv_mcast_forw_mode() selection code: * batadv_interface_tx * batadv_mcast_forw_mode * batadv_mcast_forw_mode_by_count() * batadv_mcast_forw_push() -> calls batadv_mcast_forw_expand_head() before everything else * batadv_mcast_forw_push_tvlvs() * batadv_mcast_forw_push_dests() * batadv_mcast_forw_push_adjust_padding() * batadv_mcast_forw_scrape()

CVSS

No CVSS.

References

Link	Resource
https://git.kernel.org/stable/c/2879177539e3ece483a8e5406970373698e9a6c5
https://git.kernel.org/stable/c/6a30a59e2660afd03c975f1b8eae6a2301161197
https://git.kernel.org/stable/c/a9603e0a7cb5e0cddc6b23af153cf7daafc5c55e
https://git.kernel.org/stable/c/c32e5e25c41201c8c3b796a4ab2c45103187091e

Configurations

No configuration.

History

No history.

Information

Published : 2026-09-16 11:17

Updated : 2026-09-16 11:17

NVD link : CVE-2026-89950

Mitre link : CVE-2026-89950

CVE.ORG link : CVE-2026-89950

JSON object : View

Products Affected

No product.

CWE

No CWE.

{"id": "CVE-2026-89950", "cveTags": [], "metrics": {}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "90039133221e33964ccb4a536dad7eb0a372fff7", "lessThan": "a9603e0a7cb5e0cddc6b23af153cf7daafc5c55e", "versionType": "git"}, {"status": "affected", "version": "90039133221e33964ccb4a536dad7eb0a372fff7", "lessThan": "c32e5e25c41201c8c3b796a4ab2c45103187091e", "versionType": "git"}, {"status": "affected", "version": "90039133221e33964ccb4a536dad7eb0a372fff7", "lessThan": "2879177539e3ece483a8e5406970373698e9a6c5", "versionType": "git"}, {"status": "affected", "version": "90039133221e33964ccb4a536dad7eb0a372fff7", "lessThan": "6a30a59e2660afd03c975f1b8eae6a2301161197", "versionType": "git"}], "programFiles": ["net/batman-adv/multicast_forw.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.8"}, {"status": "unaffected", "version": "0", "lessThan": "6.8", "versionType": "semver"}, {"status": "unaffected", "version": "6.12.110", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.51", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.2.5", "versionType": "semver", "lessThanOrEqual": "7.2.*"}, {"status": "unaffected", "version": "7.3-rc1", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["net/batman-adv/multicast_forw.c"], "defaultStatus": "affected"}]}], "published": "2026-09-16T11:17:05.160", "references": [{"url": "https://git.kernel.org/stable/c/2879177539e3ece483a8e5406970373698e9a6c5", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/6a30a59e2660afd03c975f1b8eae6a2301161197", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/a9603e0a7cb5e0cddc6b23af153cf7daafc5c55e", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/c32e5e25c41201c8c3b796a4ab2c45103187091e", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Received", "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbatman-adv: mcast: linearize skbuff for packet generation\n\nbatadv_mcast_forw_packet() and batadv_mcast_forw_scrape() is not only\ncalled (indirectly) by the unsharing+linearizing batadv_recv_mcast_packet()\nhandler. When it is called (indirectly) by batadv_mcast_forw_mcsend() then\nit will be unshared but not linearized. The SKB_LINEAR_ASSERT() can\ntherefore cause a fatal BUG().\n\nThe linearization should happen during the expansion of the head because\nthe scrape function can be hit already during the initial\nbatadv_mcast_forw_mode() selection code:\n\n* batadv_interface_tx\n* batadv_mcast_forw_mode\n* batadv_mcast_forw_mode_by_count()\n* batadv_mcast_forw_push()\n -> calls batadv_mcast_forw_expand_head() before everything else\n* batadv_mcast_forw_push_tvlvs()\n* batadv_mcast_forw_push_dests()\n* batadv_mcast_forw_push_adjust_padding()\n* batadv_mcast_forw_scrape()"}], "lastModified": "2026-09-16T11:17:05.160", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}