The Linux kernel's batman-adv module's tp_meter component had a vulnerability where an attacker could exploit the unacked_list by sending messages with small lengths and crafted sequence numbers with gaps. This forced the receiver to allocate an increasing number of unacked_list entries, potentially causing out-of-memory conditions or significant CPU overhead due to list management. The fix involves restricting the number of unacked_list entries and dropping the highest sequence number entry when the list exceeds the limit, ensuring the process continues correctly without getting stuck on high sequence numbers.

An attacker could cause resource exhaustion on the affected system by forcing the allocation of a large number of unacked_list entries, leading to out-of-memory conditions or degraded performance due to excessive CPU usage managing the large list.

A fix has been implemented to restrict the number of unacked_list entries and properly manage the list by dropping the last entry when the limit is exceeded. Users should apply the official Linux kernel updates that include this fix. Patch status is not yet confirmed in the provided data — check the vendor advisory for current remediation guidance.