CVE-2026-52919

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> batman-adv: fix tp_meter counter underflow during shutdown<br /> <br /> batadv_tp_sender_shutdown() unconditionally decrements the "sending"<br /> atomic counter. If multiple paths (e.g. timeout, user cancel, and<br /> normal finish) call this function, the counter can underflow to -1.<br /> <br /> Since the sender logic treats any non-zero value as "still sending",<br /> a negative value causes the sender kthread to loop indefinitely.<br /> This leads to a use-after-free when the interface is removed while<br /> the zombie thread is still active.<br /> <br /> Fix this by using atomic_xchg() to ensure the counter only transitions<br /> from 1 to 0 once.<br /> <br /> [sven: added missing change in batadv_tp_send]