CVE-2021-47482 is a medium severity vulnerability in the Linux kernel's batman-adv (Better Approach To Mobile Adhoc Networking - Advanced) mesh networking protocol implementation. The issue stems from improper error handling in the batadv_mesh_init() function. Specifically, when initialization of various batadv_*_init() subcomponents fails, batadv_mesh_init() previously called batadv_mesh_free() to clean up. However, this cleanup function assumes that all subcomponents were successfully initialized, which is not always the case. This leads to attempts to free or access uninitialized fields, causing undefined behavior such as kernel General Protection Faults (GPF). The root cause is the lack of indicators to track which parts of the batman-adv subsystem were successfully initialized before an error occurred. The vulnerability was identified by Syzbot, an automated kernel bug-finding tool, which detected ODEBUG warnings and triggered GPFs during error handling paths. The fix involves changing the error handling approach to unwind initialization calls one by one, ensuring that only initialized components are cleaned up. This not only prevents accessing uninitialized memory but also improves performance by avoiding unnecessary free calls. The vulnerability does not affect confidentiality or integrity directly but impacts availability by causing kernel crashes (denial of service). The CVSS 3.1 score is 5.3 (medium), reflecting network attack vector, high attack complexity, low privileges required, no user interaction, and impact limited to availability. No known exploits are reported in the wild as of the publication date. The affected versions are specific Linux kernel commits identified by SHA hashes, indicating this is a recent patch addressing the issue.

For European organizations, the primary impact of CVE-2021-47482 is the potential for denial of service on Linux systems running the batman-adv mesh networking protocol. This protocol is used in specialized networking scenarios such as mesh networks for community wireless projects, IoT deployments, or ad hoc mobile networks. Organizations relying on such mesh networks for critical communications or infrastructure could experience kernel crashes leading to service interruptions. While the vulnerability does not allow privilege escalation or data compromise, the availability impact could disrupt operations, especially in sectors like telecommunications, smart city infrastructure, or industrial IoT where mesh networking is employed. Given the medium severity and the requirement for network access with high attack complexity, widespread exploitation is less likely, but targeted attacks or accidental crashes could still affect network stability. European entities using Linux kernels with batman-adv enabled should prioritize patching to maintain network reliability and avoid unexpected downtime.

1. Apply the latest Linux kernel updates that include the patch for CVE-2021-47482 to ensure proper error handling in batman-adv. 2. Audit systems to identify if batman-adv is enabled and in use; disable the module if mesh networking is not required to reduce attack surface. 3. For systems requiring batman-adv, implement monitoring for kernel ODEBUG warnings and GPFs to detect early signs of exploitation or instability. 4. Employ network segmentation to limit exposure of mesh networking interfaces to untrusted networks, reducing the risk of remote exploitation. 5. Conduct thorough testing of mesh network configurations after patching to confirm stability and proper error handling. 6. Maintain up-to-date incident response plans for kernel-level crashes affecting network availability, including rapid rollback or failover procedures.