CVE-2025-21823

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

batman-adv: Drop unmanaged ELP metric worker

The ELP worker needs to calculate new metric values for all neighbors

"reachable" over an interface. Some of the used metric sources require

locks which might need to sleep. This sleep is incompatible with the RCU

list iterator used for the recorded neighbors. The initial approach to work

around of this problem was to queue another work item per neighbor and then

run this in a new context.

Even when this solved the RCU vs might_sleep() conflict, it has a major

problems: Nothing was stopping the work item in case it is not needed

anymore - for example because one of the related interfaces was removed or

the batman-adv module was unloaded - resulting in potential invalid memory

accesses.

Directly canceling the metric worker also has various problems:

* cancel_work_sync for a to-be-deactivated interface is called with

rtnl_lock held. But the code in the ELP metric worker

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References