--- cve: "CVE-2026-52916" severity: "LOW" cvss: 3.1 epss: "12%" vendor: "Linux" kev: false exploited: false published: "2026-06-24 08:16:21" tags: [cve, security, low] source: tsecurity.de CVE-Dossier exported: "2026-09-18T05:11:02+02:00" --- # CVE-2026-52916 > 3.1 LOW ## Beschreibung In the Linux kernel, the following vulnerability has been resolved: batman-adv: frag: disallow unicast fragment in fragment batadv_frag_skb_buffer() is called by batadv_batman_skb_recv() when a BATADV_UNICAST_FRAG packet is received. Once all fragments are collected and the packet is reassembled, batadv_recv_frag_packet() calls batadv_batman_skb_recv() again to process the defragmented payload. A malicious sender can craft a BATADV_UNICAST_FRAG packet whose reassembled payload is itself a BATADV_UNICAST_FRAG packet (matryoshka-style nesting). Each nesting level recurses through batadv_batman_skb_recv() without bound, growing the kernel stack until it is exhausted. Since refragmentation or fragments in fragments are not actually allowed, discard all packets which are still BATADV_UNICAST_FRAG packets after the defragmentation process. ## Patch verfügbar (OSV) - Kernel ≥ 5.10.258 - Kernel ≥ 5.15.209 - Kernel ≥ 6.1.175 - Kernel ≥ 6.6.142 - Kernel ≥ 6.12.92 - Kernel ≥ 6.18.34 - Kernel ≥ 7.0.11 ## Referenzen - - - - - - - - --- _Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/cve?cve=CVE-2026-52916) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI BITS_