CVE-2024-35982 is a vulnerability in the Linux kernel's batman-adv (Better Approach To Mobile Adhoc Networking - advanced) module, which is used for mesh networking. The issue arises when the MTU (Maximum Transmission Unit) of an attached interface becomes too small to accommodate the local translation table (TT) entries required for packet transmission. Specifically, if the MTU is reduced below a threshold where even the header plus VLAN-specific data cannot fit, the batman-adv module enters an infinite loop attempting to resize the local TT to fit within the MTU constraints. This loop results in continuous log spam with messages like "batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (110)" and the resizing function never completes. The timeout used to reduce the table size halves repeatedly until it stagnates at zero, preventing further reduction and resolution of the issue. This can occur in scenarios such as having multiple VLANs stacked on batman-adv interfaces or a high number of non-purgable MAC addresses in the local TT, which increase the required size beyond the MTU. The vulnerability stems from batman-adv's reactive event handling, which cannot prevent incompatible system configurations like MTU reductions or addition of non-purgable MAC addresses. Consequently, the code must be resilient to handle these problematic states gracefully. The vulnerability impacts availability by causing a denial of service (DoS) condition through resource exhaustion and infinite processing loops within the kernel networking stack. The CVSS 3.1 score is 5.1 (medium severity), reflecting a local attack vector with high attack complexity, no privileges required, no user interaction, and impact limited to availability. No known exploits are reported in the wild as of the publication date. The vulnerability is addressed by code changes that ensure the resizing logic can handle these edge cases without infinite looping or log spamming.

For European organizations, this vulnerability poses a risk primarily to systems using the batman-adv mesh networking protocol on Linux kernels, which may be deployed in specialized networking environments such as research networks, IoT deployments, or community mesh networks. The impact is a denial of service condition that can degrade network availability and reliability, potentially disrupting critical communications or services relying on mesh networking. While the attack requires local access and specific network configurations (low MTU and multiple VLANs or non-purgable MAC addresses), the complexity and subtlety of the conditions mean that inadvertent misconfigurations could trigger the issue, causing unexpected outages. Organizations operating Linux-based mesh networks in industrial, academic, or municipal contexts in Europe should be aware of this risk. The vulnerability does not affect confidentiality or integrity but can cause significant availability issues, which in critical infrastructure or service provider contexts could have cascading effects. Given the medium severity and local attack vector, the threat is moderate but should not be ignored, especially in environments where batman-adv is used extensively.

1. Apply the latest Linux kernel patches that address CVE-2024-35982 as soon as they become available to ensure the resizing logic in batman-adv handles low MTU and VLAN configurations correctly without infinite loops. 2. Audit and monitor network interface MTU settings and VLAN configurations on systems using batman-adv to avoid configurations where MTU is set too low to support the translation table size requirements. 3. Limit the number of non-purgable MAC addresses in the local translation table to reduce the risk of exceeding packet size limits. 4. Implement proactive configuration management policies that prevent or alert on MTU reductions or VLAN additions that could trigger this condition. 5. Enhance logging and monitoring to detect repeated batman-adv log messages indicating resizing attempts, which could signal an ongoing or impending DoS condition. 6. Where possible, isolate mesh networking nodes or restrict local access to trusted administrators to reduce the risk of malicious or accidental triggering of this vulnerability. 7. Consider fallback or redundancy mechanisms in mesh network design to maintain availability if a node becomes unresponsive due to this issue.