APPLIED[N:hwe-6.17]: [SRU][Q][PATCH 0/1] CVE-2026-52931

[Edoardo Canepa]

Applied to n:linux/hwe-6.17-next. Thanks.

On 7/16/26 14:31, Cengiz Can via kernel-team wrote:
> https://ubuntu.com/security/CVE-2026-52931
>
> [ Impact ]
>
> batadv_tp_recv_ack() and batadv_tp_stop() in the batman-adv throughput meter
> are only valid for tp_vars in the BATADV_TP_SENDER role. When called with a
> BATADV_TP_RECEIVER role, they proceed to read sender-only members that were
> never initialized, leading to undefined behavior. This can be triggered when a
> node currently acting as a receiver in an ongoing tp_meter session receives a
> malicious ACK packet.
>
> [ Fix ]
>
> questing: clean cherry-pick
> focal: clean cherry-pick
> bionic: clean cherry-pick
>
> [ Test Plan ]
>
> Boot tested.
>
> [ Where Problems Could Occur ]
>
> A regression would be confined to the batman-adv throughput meter (tp_meter)
> code path. If the role check is incorrect, it could prematurely abort
> legitimate sender sessions or fail to prevent access to uninitialized state,
> affecting mesh networking users relying on tp_meter.
>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature.asc
Type: application/pgp-signature
Size: 840 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/kernel-team/attachments/20260730/043a98da/attachment-0001.sig>