CVE-2026-72232 (GCVE-0-2026-72232)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:54 – Updated: 2026-08-17 05:41
VLAI
Title
batman-adv: ensure minimal ethernet header on TX
Summary
In the Linux kernel, the following vulnerability has been resolved: batman-adv: ensure minimal ethernet header on TX As documented in commit 8bd67ebb50c0 ("net: bridge: xmit: make sure we have at least eth header len bytes"), it is possible by for a local user with eBPF TC hook access to attach a tc filter which truncates the packet and redirects to an batadv interface. But the code assumes that at least ETH_HLEN bytes are available and thus might read outside of the available buffer. The batadv_interface_tx() must therefore always check itself if enough data is available for the ethernet header and don't rely on min_header_len.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: c6c8fea29769d998d94fcec9b9f14d4b52b349d3 , < 58799078afebd5115e052bf69ad6697f9759dd6f (git)
Affected: c6c8fea29769d998d94fcec9b9f14d4b52b349d3 , < 38cd10b0aeec755d89f78722a2b83f4088ff0cb0 (git)
Affected: c6c8fea29769d998d94fcec9b9f14d4b52b349d3 , < 811fea37620f2097955d95ce81cfdba03fd30f1b (git)
Affected: c6c8fea29769d998d94fcec9b9f14d4b52b349d3 , < e6640923afee619d9fa82b07394dc9498e202304 (git)
Affected: c6c8fea29769d998d94fcec9b9f14d4b52b349d3 , < 6b4f521e01257387906f8b969ad3450d8208d4e2 (git)
Affected: c6c8fea29769d998d94fcec9b9f14d4b52b349d3 , < 9e16b6751a8206de0b865d99bb02771e6751d12d (git)
Affected: c6c8fea29769d998d94fcec9b9f14d4b52b349d3 , < dbeb4145d9778f922f459935da9a027750765a69 (git)
Affected: c6c8fea29769d998d94fcec9b9f14d4b52b349d3 , < 49df66b7993c80b80c7eb9a84ba5b3410c8296a0 (git)
guessed Create a notification for this product.
Linux Linux Affected: 2.6.38
Unaffected: 0 , < 2.6.38 (semver)
Unaffected: 5.10.261 , ≤ 5.10.* (semver)
Unaffected: 5.15.212 , ≤ 5.15.* (semver)
Unaffected: 6.1.178 , ≤ 6.1.* (semver)
Unaffected: 6.6.145 , ≤ 6.6.* (semver)
Unaffected: 6.12.97 , ≤ 6.12.* (semver)
Unaffected: 6.18.40 , ≤ 6.18.* (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/batman-adv/mesh-interface.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "58799078afebd5115e052bf69ad6697f9759dd6f",
              "status": "affected",
              "version": "c6c8fea29769d998d94fcec9b9f14d4b52b349d3",
              "versionType": "git"
            },
            {
              "lessThan": "38cd10b0aeec755d89f78722a2b83f4088ff0cb0",
              "status": "affected",
              "version": "c6c8fea29769d998d94fcec9b9f14d4b52b349d3",
              "versionType": "git"
            },
            {
              "lessThan": "811fea37620f2097955d95ce81cfdba03fd30f1b",
              "status": "affected",
              "version": "c6c8fea29769d998d94fcec9b9f14d4b52b349d3",
              "versionType": "git"
            },
            {
              "lessThan": "e6640923afee619d9fa82b07394dc9498e202304",
              "status": "affected",
              "version": "c6c8fea29769d998d94fcec9b9f14d4b52b349d3",
              "versionType": "git"
            },
            {
              "lessThan": "6b4f521e01257387906f8b969ad3450d8208d4e2",
              "status": "affected",
              "version": "c6c8fea29769d998d94fcec9b9f14d4b52b349d3",
              "versionType": "git"
            },
            {
              "lessThan": "9e16b6751a8206de0b865d99bb02771e6751d12d",
              "status": "affected",
              "version": "c6c8fea29769d998d94fcec9b9f14d4b52b349d3",
              "versionType": "git"
            },
            {
              "lessThan": "dbeb4145d9778f922f459935da9a027750765a69",
              "status": "affected",
              "version": "c6c8fea29769d998d94fcec9b9f14d4b52b349d3",
              "versionType": "git"
            },
            {
              "lessThan": "49df66b7993c80b80c7eb9a84ba5b3410c8296a0",
              "status": "affected",
              "version": "c6c8fea29769d998d94fcec9b9f14d4b52b349d3",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/batman-adv/mesh-interface.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.38"
            },
            {
              "lessThan": "2.6.38",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.261",
                  "versionStartIncluding": "2.6.38",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "2.6.38",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "2.6.38",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "2.6.38",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "2.6.38",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "2.6.38",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "2.6.38",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "2.6.38",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbatman-adv: ensure minimal ethernet header on TX\n\nAs documented in commit 8bd67ebb50c0 (\"net: bridge: xmit: make sure we have\nat least eth header len bytes\"), it is possible by for a local user with\neBPF TC hook access to attach a tc filter which truncates the packet and\nredirects to an batadv interface. But the code assumes that at least\nETH_HLEN bytes are available and thus might read outside of the available\nbuffer.\n\nThe batadv_interface_tx() must therefore always check itself if enough data\nis available for the ethernet header and don\u0027t rely on min_header_len."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Reachable only via local ndo_start_xmit on a batadv netdev after a TC/eBPF program (bpf_redirect/bpf_clone_redirect or mirred) truncates an skb below ETH_HLEN; there is no credible remote or adjacent path without local TC/BPF control.\nAC:L - An attacker with CAP_NET_ADMIN can reliably attach a TC clsact filter, shrink the skb (e.g. bpf_skb_adjust_room), and redirect to bat0; no race or victim state beyond attacker-controlled namespace setup is required.\nPR:L - Exploitation requires CAP_NET_ADMIN to attach TC/BPF programs and create/use a batadv interface; this capability is obtainable by unprivileged users inside user/network namespaces (unshare -Urn), not only init-namespace root.\nUI:N - No victim interaction is needed; the attacker triggers the bug by installing the TC filter and transmitting or test-running the crafted skb themselves.\nS:U - Impact remains within the kernel/network stack security authority (memory disclosure, mesh state corruption, crash); it does not by itself cross a VM, container, or IOMMU boundary.\nC:H - Missing ETH_HLEN validation causes an out-of-bounds read of up to 12 bytes past skb-\u003etail via eth_hdr(), exposing adjacent slab/uninitialized kernel memory and enabling heap grooming for further exploitation.\nI:H - OOB-read ethernet header fields drive batadv_tt_local_add, DAT/ARP snooping, and mesh forwarding decisions, corrupting translation/routing state; kernel OOB reads are also commonly chained into arbitrary write primitives.\nA:H - Reading beyond the skb buffer can trigger kernel oops/panic (as seen in the analogous bridge/bpf_redirect syzbot reports) and enables repeated, attacker-controlled crashes on mesh nodes running batman-adv."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:41:49.683Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/58799078afebd5115e052bf69ad6697f9759dd6f"
        },
        {
          "url": "https://git.kernel.org/stable/c/38cd10b0aeec755d89f78722a2b83f4088ff0cb0"
        },
        {
          "url": "https://git.kernel.org/stable/c/811fea37620f2097955d95ce81cfdba03fd30f1b"
        },
        {
          "url": "https://git.kernel.org/stable/c/e6640923afee619d9fa82b07394dc9498e202304"
        },
        {
          "url": "https://git.kernel.org/stable/c/6b4f521e01257387906f8b969ad3450d8208d4e2"
        },
        {
          "url": "https://git.kernel.org/stable/c/9e16b6751a8206de0b865d99bb02771e6751d12d"
        },
        {
          "url": "https://git.kernel.org/stable/c/dbeb4145d9778f922f459935da9a027750765a69"
        },
        {
          "url": "https://git.kernel.org/stable/c/49df66b7993c80b80c7eb9a84ba5b3410c8296a0"
        }
      ],
      "title": "batman-adv: ensure minimal ethernet header on TX",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-72232",
    "datePublished": "2026-08-15T05:54:22.864Z",
    "dateReserved": "2026-08-09T03:40:39.913Z",
    "dateUpdated": "2026-08-17T05:41:49.683Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-72232",
      "date": "2026-09-21",
      "epss": "0.00156",
      "percentile": "0.05137"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "net/batman-adv/mesh-interface.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "58799078afebd5115e052bf69ad6697f9759dd6f",
                    "status": "affected",
                    "version": "c6c8fea29769d998d94fcec9b9f14d4b52b349d3",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "38cd10b0aeec755d89f78722a2b83f4088ff0cb0",
                    "status": "affected",
                    "version": "c6c8fea29769d998d94fcec9b9f14d4b52b349d3",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "811fea37620f2097955d95ce81cfdba03fd30f1b",
                    "status": "affected",
                    "version": "c6c8fea29769d998d94fcec9b9f14d4b52b349d3",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "e6640923afee619d9fa82b07394dc9498e202304",
                    "status": "affected",
                    "version": "c6c8fea29769d998d94fcec9b9f14d4b52b349d3",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6b4f521e01257387906f8b969ad3450d8208d4e2",
                    "status": "affected",
                    "version": "c6c8fea29769d998d94fcec9b9f14d4b52b349d3",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "9e16b6751a8206de0b865d99bb02771e6751d12d",
                    "status": "affected",
                    "version": "c6c8fea29769d998d94fcec9b9f14d4b52b349d3",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "dbeb4145d9778f922f459935da9a027750765a69",
                    "status": "affected",
                    "version": "c6c8fea29769d998d94fcec9b9f14d4b52b349d3",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "49df66b7993c80b80c7eb9a84ba5b3410c8296a0",
                    "status": "affected",
                    "version": "c6c8fea29769d998d94fcec9b9f14d4b52b349d3",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "net/batman-adv/mesh-interface.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "2.6.38"
                  },
                  {
                    "lessThan": "2.6.38",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.261",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.212",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.178",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.145",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.97",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.40",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.5",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbatman-adv: ensure minimal ethernet header on TX\n\nAs documented in commit 8bd67ebb50c0 (\"net: bridge: xmit: make sure we have\nat least eth header len bytes\"), it is possible by for a local user with\neBPF TC hook access to attach a tc filter which truncates the packet and\nredirects to an batadv interface. But the code assumes that at least\nETH_HLEN bytes are available and thus might read outside of the available\nbuffer.\n\nThe batadv_interface_tx() must therefore always check itself if enough data\nis available for the ethernet header and don\u0027t rely on min_header_len."
          }
        ],
        "id": "CVE-2026-72232",
        "lastModified": "2026-08-17T06:18:24.530",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-08-15T06:21:50.137",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/38cd10b0aeec755d89f78722a2b83f4088ff0cb0"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/49df66b7993c80b80c7eb9a84ba5b3410c8296a0"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/58799078afebd5115e052bf69ad6697f9759dd6f"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/6b4f521e01257387906f8b969ad3450d8208d4e2"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/811fea37620f2097955d95ce81cfdba03fd30f1b"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/9e16b6751a8206de0b865d99bb02771e6751d12d"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/dbeb4145d9778f922f459935da9a027750765a69"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/e6640923afee619d9fa82b07394dc9498e202304"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-18T17:32:25+00:00",
      "cve": "CVE-2026-72232",
      "id": "CVE-2026-72232",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: batman-adv: ensure minimal ethernet header on TX",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-72232.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-31T16:26:50Z",
      "cve": "CVE-2026-72232",
      "id": "CVE-2026-72232",
      "initial_release_date": "2026-08-31T16:26:50Z",
      "product_status:known_affected": "321",
      "product_status:known_not_affected": "41",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-72232",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-72232.json",
      "version": "2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.