CVE-2026-52914: Linux Kernel buffer overflow (CVSS 9.8)

Description

In the Linux kernel, the following vulnerability has been resolved: batman-adv: fix fragment reassembly length accounting batman-adv keeps a running payload length for queued fragments and uses it to validate a fragment chain before reassembly. That accounting currently allows the accumulated fragment length to be truncated during updates. As a result, malformed fragment chains can bypass the intended validation and drive reassembly with inconsistent length state, leading to a local denial of service. Fix the accounting by storing the accumulated length in a length-typed field and rejecting update overflows before the existing validation logic runs. The fix was verified against the original reproducer and against valid fragment reassembly paths.

CVSS 3.1 breakdown

Attack vectorNetwork

Attack complexityLow

Privileges requiredNone

User interactionNone

ScopeUnchanged

ConfidentialityHigh

IntegrityHigh

AvailabilityHigh

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Linux Kernel≥ 3.13 < 5.10.258 · ≥ 5.11 < 5.15.209 · ≥ 5.16 < 6.1.175 · ≥ 6.13 < 6.18.34

Remediation

Fixed in

Linux Kernel≥ 5.10.258

Patch & vendor advisories

References

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

Frequently asked

Is CVE-2026-52914 being actively exploited?

CVE-2026-52914 is not in the CISA KEV catalog. Its EPSS exploit probability is 0.75%.

How severe is CVE-2026-52914?

CVE-2026-52914 has a CVSS 3.1 base score of 9.8, rated critical. EPSS estimates a 0.75% probability of exploitation.

Which products are affected by CVE-2026-52914?

Affected products include Linux Kernel.

How do I fix CVE-2026-52914?

Upgrade affected software to a fixed version, for example Linux Kernel 5.10.258 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2026-52914 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo