In the Linux kernel, the following vulnerability has been resolved:

batman-adv: frag: disallow unicast fragment in fragment

batadv_frag_skb_buffer() is called by batadv_batman_skb_recv() when a
BATADV_UNICAST_FRAG packet is received. Once all fragments are collected
and the packet is reassembled, batadv_recv_frag_packet() calls
batadv_batman_skb_recv() again to process the defragmented payload.

A malicious sender can craft a BATADV_UNICAST_FRAG packet whose reassembled
payload is itself a BATADV_UNICAST_FRAG packet (matryoshka-style nesting).
Each nesting level recurses through batadv_batman_skb_recv() without bound,
growing the kernel stack until it is exhausted.

Since refragmentation or fragments in fragments are not actually allowed,
discard all packets which are still BATADV_UNICAST_FRAG packets after the
defragmentation process.

https://git.kernel.org/stable/c/0c208fa3859e3a33a1c38bebc41d021166e94ac8

https://git.kernel.org/stable/c/5418be6c2e117bf8a316582795a8e3ff90f45e5d

https://git.kernel.org/stable/c/5895ad21c7059a652da83fb817510f7a1e962abf

https://git.kernel.org/stable/c/7138c35c9ad39a2fca6264af6b87466471f04ffc

https://git.kernel.org/stable/c/aea54d0bbe156d5ab7d00d68f66149ff41f4612a

https://git.kernel.org/stable/c/b54e459cf86943583c1aa2ee3081874e7ab1f5f3

https://git.kernel.org/stable/c/bc62216dc8e221e3781afa14430f45208bfa9af9

https://git.kernel.org/stable/c/bcda4814dc6524283c0b958882cb963d75fe411d

[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/batman-adv/fragmentation.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"610bfc6bc99bc83680d190ebc69359a05fc7f605","lessThan":"0c208fa3859e3a33a1c38bebc41d021166e94ac8","versionType":"git","status":"affected"},{"version":"610bfc6bc99bc83680d190ebc69359a05fc7f605","lessThan":"bcda4814dc6524283c0b958882cb963d75fe411d","versionType":"git","status":"affected"},{"version":"610bfc6bc99bc83680d190ebc69359a05fc7f605","lessThan":"aea54d0bbe156d5ab7d00d68f66149ff41f4612a","versionType":"git","status":"affected"},{"version":"610bfc6bc99bc83680d190ebc69359a05fc7f605","lessThan":"b54e459cf86943583c1aa2ee3081874e7ab1f5f3","versionType":"git","status":"affected"},{"version":"610bfc6bc99bc83680d190ebc69359a05fc7f605","lessThan":"5418be6c2e117bf8a316582795a8e3ff90f45e5d","versionType":"git","status":"affected"},{"version":"610bfc6bc99bc83680d190ebc69359a05fc7f605","lessThan":"5895ad21c7059a652da83fb817510f7a1e962abf","versionType":"git","status":"affected"},{"version":"610bfc6bc99bc83680d190ebc69359a05fc7f605","lessThan":"7138c35c9ad39a2fca6264af6b87466471f04ffc","versionType":"git","status":"affected"},{"version":"610bfc6bc99bc83680d190ebc69359a05fc7f605","lessThan":"bc62216dc8e221e3781afa14430f45208bfa9af9","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/batman-adv/fragmentation.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"3.13","status":"affected"},{"version":"0","lessThan":"3.13","versionType":"semver","status":"unaffected"},{"version":"5.10.258","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.209","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.175","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.142","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.92","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.34","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.0.11","lessThanOrEqual":"7.0.*","versionType":"semver","status":"unaffected"},{"version":"7.1","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]