Executive Summary

This vulnerability exists in the Linux kernel's batman-adv component, specifically in the tp_meter counter during shutdown. The function batadv_tp_sender_shutdown() decreases an atomic counter called "sending" unconditionally. If this function is called multiple times from different paths (such as timeout, user cancel, or normal finish), the counter can underflow to -1.

Because the sender logic treats any non-zero value as "still sending," a negative value causes the sender kernel thread to loop indefinitely. This results in a use-after-free condition when the network interface is removed while this zombie thread is still active.

The fix involves using atomic_xchg() to ensure the counter only transitions from 1 to 0 once, preventing the underflow.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause a kernel thread to loop indefinitely, leading to a use-after-free condition in the Linux kernel's batman-adv networking component.

Such a use-after-free can potentially cause system instability, crashes, or unpredictable behavior when the affected network interface is removed while the zombie thread is still active.

Useful 0 Not Useful 0