In the Linux kernel, the following vulnerability has been resolved:
batman-adv: fix panic during interface removal
Reference counting is used to ensure that batadvhardifneighnode and batadvhardiface are not freed before/during batadvvelpthroughputmetricupdate work is finished.
But there isn't a guarantee that the hard if will remain associated with a soft interface up until the work is finished.
This fixes a crash triggered by reboot that looks like this:
Call trace: batadvvmeshfree+0xd0/0x4dc [batmanadv] batadvvelpthroughputmetricupdate+0x1c/0xa4 processonework+0x178/0x398 workerthread+0x2e8/0x4d0 kthread+0xd8/0xdc retfromfork+0x10/0x20
(the batadvvmesh_free call is misleading, and does not actually happen)
I was able to make the issue happen more reliably by changing hardifneigh->batv.metric_work work to be delayed work. This allowed me to track down and confirm the fix.
[sven@narfation.org: prevent entering batadvvelpgetthroughput without soft_iface]
[
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"242345817961271269109514899688389258106",
"3355652560606105710736617867473503173",
"157455029274894588293907298478724682849",
"289806454382826783552772481825266846624",
"27355400054883025489457041762746892405",
"65398370991861438498690492919834214110",
"303794407072389107739898531650219773592",
"160023511279435583247204197078620576167",
"308037596775924431094186893941532234916",
"91946247325672489173666849832251428432",
"211168480317334080553072081072845196040",
"218860270242202892780400733146317870740",
"303516254985479877633569300447511610256"
]
},
"id": "CVE-2025-21781-219d1ae3",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ce3f1545bf8fa28bd05ec113679e8e6cd23af577",
"target": {
"file": "net/batman-adv/bat_v_elp.c"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"242345817961271269109514899688389258106",
"3355652560606105710736617867473503173",
"157455029274894588293907298478724682849",
"289806454382826783552772481825266846624",
"27355400054883025489457041762746892405",
"65398370991861438498690492919834214110",
"303794407072389107739898531650219773592",
"160023511279435583247204197078620576167",
"308037596775924431094186893941532234916",
"91946247325672489173666849832251428432",
"211168480317334080553072081072845196040",
"218860270242202892780400733146317870740",
"303516254985479877633569300447511610256"
]
},
"id": "CVE-2025-21781-24c5424c",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@522b1596ea19e327853804da2de60aeb9c5d6f42",
"target": {
"file": "net/batman-adv/bat_v_elp.c"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"function_hash": "188008350078675370678447771293900297139",
"length": 1665.0
},
"id": "CVE-2025-21781-4026ef6a",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ccb7276a6d26d6f8416e315b43b45e15ee7f29e2",
"target": {
"file": "net/batman-adv/bat_v_elp.c",
"function": "batadv_v_elp_get_throughput"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"function_hash": "188008350078675370678447771293900297139",
"length": 1665.0
},
"id": "CVE-2025-21781-4dea31e1",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7eb5dd201695645af071592a50026eb780081a72",
"target": {
"file": "net/batman-adv/bat_v_elp.c",
"function": "batadv_v_elp_get_throughput"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"242345817961271269109514899688389258106",
"3355652560606105710736617867473503173",
"157455029274894588293907298478724682849",
"289806454382826783552772481825266846624",
"27355400054883025489457041762746892405",
"65398370991861438498690492919834214110",
"303794407072389107739898531650219773592",
"160023511279435583247204197078620576167",
"308037596775924431094186893941532234916",
"91946247325672489173666849832251428432",
"211168480317334080553072081072845196040",
"218860270242202892780400733146317870740",
"303516254985479877633569300447511610256"
]
},
"id": "CVE-2025-21781-78a3b754",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2c3fb7df4cc6d043f70d4a8a10f8b915bbfb75e7",
"target": {
"file": "net/batman-adv/bat_v_elp.c"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"function_hash": "138637464045061222342949035292236281366",
"length": 1707.0
},
"id": "CVE-2025-21781-902199a6",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ce3f1545bf8fa28bd05ec113679e8e6cd23af577",
"target": {
"file": "net/batman-adv/bat_v_elp.c",
"function": "batadv_v_elp_get_throughput"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"242345817961271269109514899688389258106",
"3355652560606105710736617867473503173",
"157455029274894588293907298478724682849",
"289806454382826783552772481825266846624",
"27355400054883025489457041762746892405",
"65398370991861438498690492919834214110",
"303794407072389107739898531650219773592",
"160023511279435583247204197078620576167",
"308037596775924431094186893941532234916",
"91946247325672489173666849832251428432",
"211168480317334080553072081072845196040",
"218860270242202892780400733146317870740",
"303516254985479877633569300447511610256"
]
},
"id": "CVE-2025-21781-93d75b62",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ccb7276a6d26d6f8416e315b43b45e15ee7f29e2",
"target": {
"file": "net/batman-adv/bat_v_elp.c"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"function_hash": "188008350078675370678447771293900297139",
"length": 1665.0
},
"id": "CVE-2025-21781-b9d3da55",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@522b1596ea19e327853804da2de60aeb9c5d6f42",
"target": {
"file": "net/batman-adv/bat_v_elp.c",
"function": "batadv_v_elp_get_throughput"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"function_hash": "188008350078675370678447771293900297139",
"length": 1665.0
},
"id": "CVE-2025-21781-c7cab6cf",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2c3fb7df4cc6d043f70d4a8a10f8b915bbfb75e7",
"target": {
"file": "net/batman-adv/bat_v_elp.c",
"function": "batadv_v_elp_get_throughput"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"function_hash": "138637464045061222342949035292236281366",
"length": 1707.0
},
"id": "CVE-2025-21781-c7fc5f0e",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f0a16c6c79768180333f3e41ce63f32730e3c3af",
"target": {
"file": "net/batman-adv/bat_v_elp.c",
"function": "batadv_v_elp_get_throughput"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"242345817961271269109514899688389258106",
"3355652560606105710736617867473503173",
"157455029274894588293907298478724682849",
"289806454382826783552772481825266846624",
"27355400054883025489457041762746892405",
"65398370991861438498690492919834214110",
"303794407072389107739898531650219773592",
"160023511279435583247204197078620576167",
"308037596775924431094186893941532234916",
"91946247325672489173666849832251428432",
"211168480317334080553072081072845196040",
"218860270242202892780400733146317870740",
"303516254985479877633569300447511610256"
]
},
"id": "CVE-2025-21781-d9a54901",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f0a16c6c79768180333f3e41ce63f32730e3c3af",
"target": {
"file": "net/batman-adv/bat_v_elp.c"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"242345817961271269109514899688389258106",
"3355652560606105710736617867473503173",
"157455029274894588293907298478724682849",
"289806454382826783552772481825266846624",
"27355400054883025489457041762746892405",
"65398370991861438498690492919834214110",
"303794407072389107739898531650219773592",
"160023511279435583247204197078620576167",
"308037596775924431094186893941532234916",
"91946247325672489173666849832251428432",
"211168480317334080553072081072845196040",
"218860270242202892780400733146317870740",
"303516254985479877633569300447511610256"
]
},
"id": "CVE-2025-21781-eae77d1b",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7eb5dd201695645af071592a50026eb780081a72",
"target": {
"file": "net/batman-adv/bat_v_elp.c"
}
}
]