CVE-2025-21781

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

batman-adv: fix panic during interface removal

Reference counting is used to ensure that

batadv_hardif_neigh_node and batadv_hard_iface

are not freed before/during

batadv_v_elp_throughput_metric_update work is

finished.

But there isn't a guarantee that the hard if will

remain associated with a soft interface up until

the work is finished.

This fixes a crash triggered by reboot that looks

like this:

Call trace:

batadv_v_mesh_free+0xd0/0x4dc [batman_adv]

batadv_v_elp_throughput_metric_update+0x1c/0xa4

process_one_work+0x178/0x398

worker_thread+0x2e8/0x4d0

kthread+0xd8/0xdc

ret_from_fork+0x10/0x20

(the batadv_v_mesh_free call is misleading,

and does not actually happen)

I was able to make the issue happen more reliably

by changing hardif_neigh->bat_v.metric_work work

to be delayed work. This allowed me to track down

and confirm the fix.

[[email protected]: prevent entering batadv_v_elp_get_throughput withou

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References