A critical race condition in the Linux kernel batman-adv module could lead to memory corruption, posing a severe risk to system integrity and availability.

This is a Time-of-Check Time-of-Use (TOCTOU) race condition within the batman-adv subsystem, specifically regarding how local Translation Table (TT) VLAN entries are generated. An attacker can trigger this flaw by exploiting the discrepancy between buffer size calculation and the actual population of VLAN entries, which may allow an out-of-bounds memory write.

Successful exploitation of this vulnerability can result in a system crash or arbitrary code execution, depending on the memory layout. Given the CVSS score of 9.8, this represents a critical risk that could lead to full system compromise or significant service disruption for network-dependent infrastructure.

Immediate Action: Update the Linux kernel to version 5.10.259, 5.15.210, 6.1.176, 6.6.143, or a later stable release provided by your distribution vendor.

Proactive Monitoring: Monitor system logs for kernel panic events or unexpected memory access errors that may indicate exploitation attempts against the batman-adv module.

Compensating Controls: If patching is not immediately feasible, restrict access to the mesh network interfaces where batman-adv is active to trusted nodes only, thereby reducing the attack surface.

Public Exploit Available: Unknown

Due to the critical severity of this kernel-level memory corruption vulnerability, all systems utilizing the batman-adv mesh networking module should be prioritized for patching. Administrators must ensure that their kernels are updated to the specified versions or higher to eliminate the race condition and protect against potential system compromise.