CVE-2021-47252: 
Linux Kernel vulnerability analysis and mitigation

CVE-2021-47252 affects the Linux kernel's batman-adv module. The vulnerability was discovered and disclosed in May 2024, involving a timing-related issue in the batman-adv interface where the soft/batadv interface for a queued OGM can be changed between queue and transmission times (NVD).

The vulnerability exists in the batman-adv module's OGM (Originator Message) handling. Specifically, when an OGM is queued for transmission and when it is actually transmitted by the worker, the soft/batadv interface can be changed during this interval. The issue stems from improper use of WARN_ON for timing-related checks, where WARN_ON was being used to print simple warnings rather than its intended purpose of denoting kernel bugs (Kernel Commit).

The vulnerability affects the Linux kernel's network functionality through the batman-adv module. While the direct impact is limited to warning message handling, it could potentially lead to incorrect interface state handling in the batman-adv networking subsystem (NVD).

The vulnerability requires access to the batman-adv network interface and occurs during specific timing conditions when OGMs are being processed. No known exploits have been reported in the wild (NVD).

The issue has been fixed by replacing the WARN_ON check with a proper pr_warn() call for handling the soft interface switch condition. The fix was implemented in the Linux kernel through a patch that modifies the bat_iv_ogm.c file (Kernel Commit).