CVE-2026-52914

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> batman-adv: fix fragment reassembly length accounting<br /> <br /> batman-adv keeps a running payload length for queued fragments and uses it<br /> to validate a fragment chain before reassembly.<br /> <br /> That accounting currently allows the accumulated fragment length to be<br /> truncated during updates. As a result, malformed fragment chains can<br /> bypass the intended validation and drive reassembly with inconsistent<br /> length state, leading to a local denial of service.<br /> <br /> Fix the accounting by storing the accumulated length in a length-typed<br /> field and rejecting update overflows before the existing validation logic<br /> runs.<br /> <br /> The fix was verified against the original reproducer and against valid<br /> fragment reassembly paths.