CVE-2026-52931

In the Linux kernel, the following vulnerability has been resolved:

batman-adv: tp_meter: avoid use of uninit sender vars

batadv_tp_recv_ack() and batadv_tp_stop() are only valid for tp_vars in the

BATADV_TP_SENDER role. When called with a BATADV_TP_RECEIVER role, it

proceeds to read sender-only members that were never initialized, leading

to undefined behavior.

This can be triggered when a node that is currently acting as a receiver in

an ongoing tp_meter session receives a malicious ACK packet.

Guard against this by checking tp_vars->role immediately after the

lookup and bailing out if it is not BATADV_TP_SENDER, before any of

those members are accessed.