Skip to content
Heist/ feed
Back to feed
CriticalFix available

batman-adv: fix fragment reassembly length accounting

Type: advisorySources: OSV

In the Linux kernel, the following vulnerability has been resolved: batman-adv: fix fragment reassembly length accounting batman-adv keeps a running payload length for queued fragments and uses it to validate a fragment chain before reassembly. That accounting currently allows the accumulated fragment length to be truncated during updates. As a result, malformed fragment chains can bypass the intended validation and drive reassembly with inconsistent length state, leading to a local denial of service. Fix the accounting by storing the accumulated length in a length-typed field and rejecting update overflows before the existing validation logic runs. The fix was verified against the original reproducer and against valid fragment reassembly paths.

Products
Kernel
Affected versions
Not specified
Fixed versions
5.10.258, 5.15.209, 6.1.175, 6.12.92, 6.18.34, 6.6.142, 7.0.11
CVEs
CVE-2026-52914
Confirmed fixed CVEs
Not specified
Updated in this feed
3 Nov 2026, 13:32 UTC · Revision 1

Source evidence

batman-adv: fix fragment reassembly length accounting

core-osv · Original source

Published 24 Jun 2026, 07:14 UTC

In the Linux kernel, the following vulnerability has been resolved: batman-adv: fix fragment reassembly length accounting batman-adv keeps a running payload length for queued fragments and uses it to validate a fragment chain before reassembly. That accounting currently allows the accumulated fragment length to be truncated during updates. As a result, malformed fragment chains can bypass the intended validation and drive reassembly with inconsistent length state, leading to a local denial of service. Fix the accounting by storing the accumulated length in a length-typed field and rejecting update overflows before the existing validation logic runs. The fix was verified against the original reproducer and against valid fragment reassembly paths.

osv:CVE-2026-52914

Kernel

Fixed versions: 5.10.258, 5.15.209, 6.1.175, 6.6.142, 6.12.92, 6.18.34, 7.0.11

Complete source record
{
  "id": "6ec244011b007afe7cd5f6bdbdd790371a843299eb962e1b3a3ef1c2431ab2c0",
  "url": "https://osv.dev/vulnerability/CVE-2026-52914",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "batman-adv: fix fragment reassembly length accounting",
    "summary": "In the Linux kernel, the following vulnerability has been resolved: batman-adv: fix fragment reassembly length accounting batman-adv keeps a running payload length for queued fragments and uses it to validate a fragment chain before reassembly. That accounting currently allows the accumulated fragment length to be truncated during updates. As a result, malformed fragment chains can bypass the intended validation and drive reassembly with inconsistent length state, leading to a local denial of service. Fix the accounting by storing the accumulated length in a length-typed field and rejecting update overflows before the existing validation logic runs. The fix was verified against the original reproducer and against valid fragment reassembly paths.",
    "evidence": "osv:CVE-2026-52914",
    "products": [
      {
        "name": {
          "value": "Kernel",
          "evidence": "/affected/1/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "5.10.258",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "5.15.209",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.1.175",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.6.142",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.12.92",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.18.34",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "7.0.11",
            "evidence": "/affected/1/ranges"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "critical",
    "structured": {
      "id": "CVE-2026-52914",
      "aliases": [
        "CVE-2026-52914"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "type": "GIT",
              "events": [
                {
                  "introduced": "610bfc6bc99bc83680d190ebc69359a05fc7f605"
                },
                {
                  "fixed": "e4f3f6b818aa6a678bc54a2d4e0bece2303c6a64"
                },
                {
                  "fixed": "37be61825b15534a16ff9cfc9546de155b6df982"
                },
                {
                  "fixed": "975563c5de1123dde1ec7946bf5556d20c89d74e"
                },
                {
                  "fixed": "f653b040dad1af70fa5cd4fe085e4758925480c9"
                },
                {
                  "fixed": "e910dbf509125fe51ad68e4fa74dc8ab0a8e787a"
                },
                {
                  "fixed": "3eb8bcb823391bd58997831b3c9c152a4ba8e255"
                },
                {
                  "fixed": "fdb2c96efb2baeb3725e9ce3ede8f1e36f5490f0"
                },
                {
                  "fixed": "9cd3f16c320bfdadd4509358122368deb56a5741"
                }
              ]
            }
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-52914.json"
          }
        },
        {
          "ranges": [
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "3.13.0"
                },
                {
                  "fixed": "5.10.258"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "5.11.0"
                },
                {
                  "fixed": "5.15.209"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "5.16.0"
                },
                {
                  "fixed": "6.1.175"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.2.0"
                },
                {
                  "fixed": "6.6.142"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.7.0"
                },
                {
                  "fixed": "6.12.92"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.13.0"
                },
                {
                  "fixed": "6.18.34"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.19.0"
                },
                {
                  "fixed": "7.0.11"
                }
              ]
            }
          ],
          "package": {
            "name": "Kernel",
            "ecosystem": "Linux"
          },
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-52914.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:29.113960083Z",
      "provider": "osv",
      "references": [
        "https://git.kernel.org/stable/c/37be61825b15534a16ff9cfc9546de155b6df982",
        "https://git.kernel.org/stable/c/3eb8bcb823391bd58997831b3c9c152a4ba8e255",
        "https://git.kernel.org/stable/c/975563c5de1123dde1ec7946bf5556d20c89d74e",
        "https://git.kernel.org/stable/c/9cd3f16c320bfdadd4509358122368deb56a5741",
        "https://git.kernel.org/stable/c/e4f3f6b818aa6a678bc54a2d4e0bece2303c6a64",
        "https://git.kernel.org/stable/c/e910dbf509125fe51ad68e4fa74dc8ab0a8e787a",
        "https://git.kernel.org/stable/c/f653b040dad1af70fa5cd4fe085e4758925480c9",
        "https://git.kernel.org/stable/c/fdb2c96efb2baeb3725e9ce3ede8f1e36f5490f0",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/52xxx/CVE-2026-52914.json",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-52914",
        "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
      ],
      "provider_metadata": {
        "cna_assigner": "Linux",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/52xxx/CVE-2026-52914.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-52914",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 495941,
  "published_at": "2026-06-24T07:14:11.906+00:00"
}