batman-adv: Avoid double-rtnl_lock ELP metric worker

Summary

In the Linux kernel, the following vulnerability has been resolved: batman-adv: Avoid double-rtnl_lock ELP metric worker batadv_v_elp_get_throughput() might be called when the RTNL lock is already held. This could be problematic when the work queue item is cancelled via cancel_delayed_work_sync() in batadv_v_elp_iface_disable(). In this case, an rtnl_lock() would cause a deadlock. To avoid this, rtnl_trylock() was used in this function to skip the retrieval of the ethtool information in case the RTNL lock was already held. But for cfg80211 interfaces, batadv_get_real_netdev() was called - which also uses rtnl_lock(). The approach for __ethtool_get_link_ksettings() must also be used instead and the lockless version __batadv_get_real_netdev() has to be called.

Timeline

1. May 8, 2026, 2:21 PM UTCCVE published
2. May 23, 2026, 4:06 PM UTCRecord last updated

Affected versions

• Linux Linux

  From 5.10.235 · fixed in 5.10.253; From 5.15.179 · fixed in 5.15.203; From 6.1.129 · fixed in 6.1.167; From 6.6.79 · fixed in 6.6.130; From 6.12.16 · fixed in 6.12.78; From 5.4.291 · fixed in 5.5; From 6.13.4 · fixed in 6.14

• Linux Linux

  6.14

References 8