[SRU][Q][PATCH 0/1] CVE-2026-52914

[Cengiz Can]

https://ubuntu.com/security/CVE-2026-52914

[ Impact ]

batman-adv keeps a running payload length for queued fragments and uses it to
validate a fragment chain before reassembly. The accounting allows the
accumulated fragment length to be truncated during updates, so malformed
fragment chains can bypass the intended validation and drive reassembly with
inconsistent length state. This leads to a local denial of service.

[ Fix ]

questing: clean cherry-pick
focal: clean cherry-pick
bionic: backported with AI-assisted adaptation
xenial: backported with AI-assisted adaptation
trusty: backported with AI-assisted adaptation

[ Test Plan ]

Boot tested.

[ Where Problems Could Occur ]

A regression in this fix would affect the batman-adv mesh networking subsystem,
specifically fragment reassembly. Incorrect length accounting could cause valid
fragmented packets to be dropped or fail to reassemble correctly.