Technical Summary

The vulnerability in the Linux kernel's batman-adv module involves improper ordering of reference dropping and list entry removal in the function batadv_bla_del_backbone_claims(). The function removes all claims for a backbone by dropping the link entry in the hash list, which is also a reference that must be dropped via batadv_claim_put(). However, if batadv_claim_put() is called before the last access to the claim object, the claim may be freed prematurely by batadv_claim_release(), leading to a use-after-free condition. This vulnerability has been resolved in versions of the Linux kernel starting from 5.15.0-1112.119~20.04.1 and later.