ACK: [SRU][Q][PATCH 0/1] CVE-2026-52931

[Alessio Faina]

On Thu, Jul 16, 2026 at 03:31:25PM +0300, Cengiz Can via kernel-team wrote:
> https://ubuntu.com/security/CVE-2026-52931
> 
> [ Impact ]
> 
> batadv_tp_recv_ack() and batadv_tp_stop() in the batman-adv throughput meter
> are only valid for tp_vars in the BATADV_TP_SENDER role. When called with a
> BATADV_TP_RECEIVER role, they proceed to read sender-only members that were
> never initialized, leading to undefined behavior. This can be triggered when a
> node currently acting as a receiver in an ongoing tp_meter session receives a
> malicious ACK packet.
> 
> [ Fix ]
> 
> questing: clean cherry-pick
> focal: clean cherry-pick
> bionic: clean cherry-pick
> 
> [ Test Plan ]
> 
> Boot tested.
> 
> [ Where Problems Could Occur ]
> 
> A regression would be confined to the batman-adv throughput meter (tp_meter)
> code path. If the role check is incorrect, it could prematurely abort
> legitimate sender sessions or fail to prevent access to uninitialized state,
> affecting mesh networking users relying on tp_meter.
> 
> -- 
> kernel-team mailing list
> kernel-team at lists.ubuntu.com
> https://lists.ubuntu.com/mailman/listinfo/kernel-team

Acked-by: Alessio Faina <alessio.faina at canonical.com>