CVE-2025-21823 is a vulnerability identified in the Linux kernel's batman-adv (Better Approach To Mobile Adhoc Networking - advanced) module, which is responsible for mesh networking functionality. The issue arises from the handling of the ELP (Echo Location Protocol) metric worker, which calculates metric values for neighbors reachable over an interface. The original implementation used a per-neighbor work item queued to handle metric calculations, but this approach had significant flaws. Specifically, there was no mechanism to stop these work items if they became unnecessary, such as when an interface was removed or the batman-adv module was unloaded. This could lead to invalid memory accesses, causing potential kernel crashes or undefined behavior. Attempts to cancel these work items synchronously (using cancel_work_sync) led to deadlocks because the cancellation was performed while holding the rtnl_lock, which the worker also tried to acquire, causing a circular wait. Additionally, the iteration over neighbor lists used RCU (Read-Copy-Update) methods without proper locking, which is acceptable for periodic metric checks but unsafe for cleanup routines that must ensure all workers are stopped. The fix involves removing the per-interface neighbor metric worker and consolidating metric gathering into the interface worker. This approach creates a list of neighbors needing metric updates within an RCU-protected context and performs metric gathering outside this context. It also uses rcu_trylock to avoid deadlocks during interface removal when cancel_delayed_work_sync is called with rtnl_lock held. This redesign prevents invalid memory accesses, deadlocks, and ensures proper cleanup of worker threads during interface or module teardown.

For European organizations, especially those relying on Linux-based infrastructure for networking, including mesh networks or embedded systems using batman-adv, this vulnerability could lead to system instability or denial of service due to kernel crashes or deadlocks. While there is no indication of remote code execution or privilege escalation, the potential for invalid memory access and deadlocks can disrupt critical network services, impacting availability. Organizations operating in sectors such as telecommunications, public safety, transportation, and industrial control systems that utilize mesh networking may experience outages or degraded performance. Additionally, embedded devices running vulnerable Linux kernels could be affected, potentially impacting IoT deployments common in smart city initiatives across Europe. The lack of known exploits in the wild reduces immediate risk, but the complexity of the issue and its kernel-level nature mean that unpatched systems remain vulnerable to stability issues, which could be exploited indirectly by attackers aiming to cause disruption.

European organizations should prioritize updating their Linux kernels to versions where this vulnerability is patched. Since the issue is in the batman-adv module, systems not using this module are not directly affected, so auditing and disabling unused kernel modules can reduce exposure. For systems requiring batman-adv, ensure kernel updates are applied promptly. Network administrators should monitor system logs for signs of kernel panics or deadlocks related to batman-adv. In environments where kernel updates are delayed, consider isolating affected systems or limiting interface removals and module unload operations to maintenance windows to reduce the risk of triggering the vulnerability. Additionally, testing kernel updates in staging environments before deployment can prevent unexpected downtime. For embedded devices, coordinate with vendors to obtain patched firmware. Finally, implement robust backup and recovery procedures to mitigate potential service disruptions caused by this vulnerability.