CVE-2026-89950
In the Linux kernel, the following vulnerability has been resolved: batman-adv: mcast: linearize skbuff for packet generation batadv_mcast_forw_packet() and batadv_mcast_forw_scrape() is not only called (indirectly) by the unsharing+linearizing batadv_recv_mcast_packet() handler. When it is called (indirectly) by batadv_mcast_forw_mcsend() then it will be unshared but not linearized. The SKB_LINEAR_ASSERT() can therefore cause a fatal BUG(). The linearization should happen during the expansion of the head because the scrape function can be hit already during the initial batadv_mcast_forw_mode() selection code: * batadv_interface_tx * batadv_mcast_forw_mode * batadv_mcast_forw_mode_by_count() * batadv_mcast_forw_push() -> calls batadv_mcast_forw_expand_head() before everything else * batadv_mcast_forw_push_tvlvs() * batadv_mcast_forw_push_dests() * batadv_mcast_forw_push_adjust_padding() * batadv_mcast_forw_scrape()
Affected versions
Linux kernel versions
6.8
and later are affected. Fixed in
6.12.110,
6.18.51,
7.2.5,
7.3-rc1
and their respective stable series.
References
4 totalFrequently asked questions
-
What is CVE-2026-89950?
CVE-2026-89950 is a unscored severity Linux kernel vulnerability . It affects Linux kernel versions from 6.8 onward and has been patched in 6.12.110, 6.18.51, 7.2.5 and others. CVE-2026-89950 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
-
Is there a patch available for CVE-2026-89950?
Yes. CVE-2026-89950 has been patched. Fixed versions include 6.12.110, 6.18.51, 7.2.5 and others. If you are running Linux kernel 6.8 or later up to the fix versions, apply the relevant patch for your kernel branch.
-
Is CVE-2026-89950 actively exploited?
No. CVE-2026-89950 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.