batman-adv: stop tp_meter sessions during mesh teardown
At a glance
Severity
HIGH 7.8
EPSS
EPSS 0.14 % · percentile 3 (2026-10-27)
State
PUBLISHED
Published
Updated
Assigner
Linux
NVD status
Modified
Description
In the Linux kernel, the following vulnerability has been resolved:
batman-adv: stop tp_meter sessions during mesh teardown
TP meter sessions remain linked on bat_priv->tp_list after the netlink
request has already finished. When the mesh interface is removed,
batadv_mesh_free() currently tears down the mesh without first draining
these sessions.
A running sender thread or a late incoming tp_meter packet can then keep
processing against a mesh instance which is already shutting down.
Synchronize tp_meter with the mesh lifetime by stopping all active
sessions from batadv_mesh_free() and waiting for sender threads to exit
before teardown continues.
