CVE-2026-43382: Linux Kernel

Medium severity, CVSS 5.5. EPSS: 0.1% chance of exploitation in the next 30 days.

In the Linux kernel, the following vulnerability has been resolved: batman-adv: Avoid double-rtnl_lock ELP metric worker batadv_v_elp_get_throughput() might be called when the RTNL lock is already held. This could be problematic when the work queue item is cancelled via cancel_delayed_work_sync() in batadv_v_elp_iface_disable(). In this case, an rtnl_lock() would cause a deadlock. To avoid this, rtnl_trylock() was used in this function to skip the retrieval of the ethtool information in case the RTNL lock was already held. But for cfg80211 interfaces, batadv_get_real_netdev() was called - which also uses rtnl_lock(). The approach for __ethtool_get_link_ksettings() must also be used instead and the lockless version __batadv_get_real_netdev() has to be called.

Affected products

• Linux Linux Kernel: from 5.4.291, before 5.5 (fixed in 5.5); from 5.10.235, before 5.10.253 (fixed in 5.10.253); from 5.15.179, before 5.15.203 (fixed in 5.15.203); from 6.1.129, before 6.1.167 (fixed in 6.1.167); from 6.6.79, before 6.6.130 (fixed in 6.6.130); from 6.12.16, before 6.12.78 (fixed in 6.12.78); …

Published 2026-05-08. Last modified 2026-06-17.