rootpwn

medium

CVE-2026-93204

The Linux kernel’s batman-adv module previously allowed a MAC address to be partially updated, enabling a reader to see a corrupted address.

Overview

The Linux kernel’s batman-adv module previously allowed a MAC address to be partially updated, enabling a reader to see a corrupted address. This could lead to ARP cache poisoning or malformed ARP responses, potentially allowing traffic interception or tampering.

Description

In the Linux kernel, the following vulnerability has been resolved: batman-adv: dat: atomically update mac addresses When a MAC address is updated in batadv_dat_entry_add(), it is done using a simple copy function. A parallel reader might only see parts of this update. In worst case, the reader is transporting the half updated MAC address over the network or is creating an ARP response using it - poisoning the ARP cache. atomic64_t can be used to store the 48 bit of a mac address. A reader will then either see the old mac address or the new one - never a mixture of both.

Impact

{'confidentiality': 'Potential data interception via ARP spoofing', 'integrity': 'Risk of traffic tampering or man‑in‑the‑middle attacks', 'availability': 'No direct denial‑of‑service impact'}

Remediation

['Upgrade the Linux kernel to a version that includes the batman-adv patch (use the latest stable release).', 'If using a custom kernel, rebuild batman-adv with the atomic64_t update for MAC addresses.', 'Verify that the batman-adv module is loaded and running the patched version.', 'Implement ARP cache monitoring and automatic ARP flux detection to detect anomalous entries.', 'Apply network segmentation and restrict administrative access to the mesh network to limit local attacker reach.']

Risk context

Medium severity with no CVSS or EPSS score; the vulnerability is exploitable by an attacker with network access to a batman-adv mesh. Prompt kernel updates mitigate the risk.

Affected products

  • Linux kernel
  • batman-adv
  • B.A.T.M.A.N. Advanced
  • Linux networking stack
  • Open-source networking

Scores

Severity
medium
CVSS v2
6.4
CVSS v3
—
CVSS v4
—
EPSS
—

ARP poisoning batman-adv kernel MAC address network security confidentiality integrity

← All CVEs

Related CVEs

medium

CVE-2026-92526

A flaw has been found in itsourcecode Leave Management System 1.0. This affects an unknown function of the file /module/leave/index.php. Executing a manipulation of the argument ID can lead to sql injection. The attack may be launched remotely. The exploit has been published and may be used.

View analysis

medium

CVE-2026-93157

In the Linux kernel, the following vulnerability has been resolved: hwrng: xilinx-trng - propagate timeout before any data is read xtrng_readblock32() polls for 16-byte chunks but returns the number of bytes read even when the first poll times out. Its caller then treats a zero return as a short successful read, and partial reads for full 32-byte blocks can make the tail copy use a fixed block offset rather than the amount already produced. Return the poll error when no data has been read, preserve partial positive returns after some data is available, stop the generator on all collection exits, and append tail bytes at the current output count.

View analysis

medium

CVE-2026-93159

In the Linux kernel, the following vulnerability has been resolved: crypto: atmel-sha204a - fix heap info leak on I2C transfer failure The nonblocking RNG path allocates a work_data structure to track the state of an in-flight asynchronous I2C request. This pointer is stored in rng->priv and later consumed by the read path once the transaction completes. If the underlying I2C transfer fails, the completion callback is invoked with a non-zero status. In this case, the allocated work_data is not usable for producing RNG output and must not remain associated with the hwrng state. Previously, the failure path only logged a warning but left the pointer state uncleared, which can result in subsequent read attempts observing stale state and interpreting it as valid completion data. Fix this by freeing the pending work_data. The I2C transaction reports an error. This ensures that failed requests do not leave residual state behind that could be interpreted as valid RNG data on later reads. Clearing rng->priv is done at the subsequent call to nonblocking read.

View analysis

medium

CVE-2026-93160

The Linux kernel’s Atmel ECC driver now checks that a public key is cached before performing a hardware ECDH operation. Previously, the driver could use a private key that wasn’t generated for the current transformation, potentially allowing misuse of keys.

View analysis