CVE-2026-72234 (GCVE-0-2026-72234)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:54 – Updated: 2026-08-17 05:41
VLAI
Title
batman-adv: access unicast_ttvn skb->data only after skb realloc
Summary
In the Linux kernel, the following vulnerability has been resolved: batman-adv: access unicast_ttvn skb->data only after skb realloc The pskb_may_pull() called by batadv_get_vid() could reallocate the buffer behind the skb. Variables which were pointing to the old buffer need to be reassigned to avoid an use-after-free. This was done correctly for the ethernet header but missed for the unicast_packet pointer.
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: c018ad3de61a1dc4194879a53e5559e094aa7b1a , < aa9558af859934f24717d4bab97d61004f91a736 (git)
Affected: c018ad3de61a1dc4194879a53e5559e094aa7b1a , < 9c2c05629e46c1fd43931506d41c56a885a98eb4 (git)
Affected: c018ad3de61a1dc4194879a53e5559e094aa7b1a , < 7b162b36de750565404cd3b98315706622c6974f (git)
Affected: c018ad3de61a1dc4194879a53e5559e094aa7b1a , < ed90eb5c68420cdfe67ec1f773324198d2ef6f50 (git)
Affected: c018ad3de61a1dc4194879a53e5559e094aa7b1a , < 979175834a699ccc3c4c0b0ba60ecae0f135a587 (git)
Affected: c018ad3de61a1dc4194879a53e5559e094aa7b1a , < b8afcf799b2cc92c41beebd029e53ed18960184a (git)
Affected: c018ad3de61a1dc4194879a53e5559e094aa7b1a , < 9a7b7248798123efbd5fafe58461d57c7cc718af (git)
Affected: c018ad3de61a1dc4194879a53e5559e094aa7b1a , < 7141990add3f75436f2933cb310654cad3b1e3e9 (git)
guessed Create a notification for this product.
Linux Linux Affected: 3.13
Unaffected: 0 , < 3.13 (semver)
Unaffected: 5.10.261 , ≤ 5.10.* (semver)
Unaffected: 5.15.212 , ≤ 5.15.* (semver)
Unaffected: 6.1.178 , ≤ 6.1.* (semver)
Unaffected: 6.6.145 , ≤ 6.6.* (semver)
Unaffected: 6.12.97 , ≤ 6.12.* (semver)
Unaffected: 6.18.40 , ≤ 6.18.* (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/batman-adv/routing.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "aa9558af859934f24717d4bab97d61004f91a736",
              "status": "affected",
              "version": "c018ad3de61a1dc4194879a53e5559e094aa7b1a",
              "versionType": "git"
            },
            {
              "lessThan": "9c2c05629e46c1fd43931506d41c56a885a98eb4",
              "status": "affected",
              "version": "c018ad3de61a1dc4194879a53e5559e094aa7b1a",
              "versionType": "git"
            },
            {
              "lessThan": "7b162b36de750565404cd3b98315706622c6974f",
              "status": "affected",
              "version": "c018ad3de61a1dc4194879a53e5559e094aa7b1a",
              "versionType": "git"
            },
            {
              "lessThan": "ed90eb5c68420cdfe67ec1f773324198d2ef6f50",
              "status": "affected",
              "version": "c018ad3de61a1dc4194879a53e5559e094aa7b1a",
              "versionType": "git"
            },
            {
              "lessThan": "979175834a699ccc3c4c0b0ba60ecae0f135a587",
              "status": "affected",
              "version": "c018ad3de61a1dc4194879a53e5559e094aa7b1a",
              "versionType": "git"
            },
            {
              "lessThan": "b8afcf799b2cc92c41beebd029e53ed18960184a",
              "status": "affected",
              "version": "c018ad3de61a1dc4194879a53e5559e094aa7b1a",
              "versionType": "git"
            },
            {
              "lessThan": "9a7b7248798123efbd5fafe58461d57c7cc718af",
              "status": "affected",
              "version": "c018ad3de61a1dc4194879a53e5559e094aa7b1a",
              "versionType": "git"
            },
            {
              "lessThan": "7141990add3f75436f2933cb310654cad3b1e3e9",
              "status": "affected",
              "version": "c018ad3de61a1dc4194879a53e5559e094aa7b1a",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/batman-adv/routing.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.13"
            },
            {
              "lessThan": "3.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.261",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbatman-adv: access unicast_ttvn skb-\u003edata only after skb realloc\n\nThe pskb_may_pull() called by batadv_get_vid() could reallocate the buffer\nbehind the skb. Variables which were pointing to the old buffer need to be\nreassigned to avoid an use-after-free.\n\nThis was done correctly for the ethernet header but missed for the\nunicast_packet pointer."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - Triggered in batadv_check_unicast_ttvn() when batadv_batman_skb_recv() processes incoming BATADV unicast packets from remote mesh peers on hard interfaces; crafted batman-adv frames reach the vulnerable code over the mesh network without local system access.\nAC:L - An attacker reliably triggers the UAF by sending a batman-adv unicast packet with a VLAN-tagged embedded Ethernet header to a victim node; packet fields are attacker-controlled and can force batadv_get_vid()\u0027s pskb_may_pull() to reallocate the skb buffer.\nPR:N - No privileges are required on the victim host; exploitation only needs batman-adv active on an interface while the attacker acts as an unauthenticated mesh peer able to transmit batman-adv protocol frames to the target node.\nUI:N - No victim user interaction is needed; the kernel automatically processes the malicious batman-adv unicast packet on receive through the normal mesh routing receive path.\nS:U - The use-after-free corrupts kernel heap memory within the same host networking subsystem and does not cross VM, container, or IOMMU boundaries to impact a separate security authority.\nC:H - The stale unicast_packet pointer dereferences freed skb buffer memory for reads (unicast_packet-\u003edest, unicast_packet-\u003ettvn), constituting a kernel heap use-after-free that can disclose sensitive memory contents.\nI:H - The stale pointer is used for writes via ether_addr_copy(unicast_packet-\u003edest) and unicast_packet-\u003ettvn updates in reroute paths, enabling heap corruption and potential arbitrary kernel code execution.\nA:H - Use-after-free on the skb data buffer during batman-adv unicast processing can cause kernel oops, panic, or hang, and UAF heap corruption inherently threatens system availability even before full exploit development."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:41:51.879Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/aa9558af859934f24717d4bab97d61004f91a736"
        },
        {
          "url": "https://git.kernel.org/stable/c/9c2c05629e46c1fd43931506d41c56a885a98eb4"
        },
        {
          "url": "https://git.kernel.org/stable/c/7b162b36de750565404cd3b98315706622c6974f"
        },
        {
          "url": "https://git.kernel.org/stable/c/ed90eb5c68420cdfe67ec1f773324198d2ef6f50"
        },
        {
          "url": "https://git.kernel.org/stable/c/979175834a699ccc3c4c0b0ba60ecae0f135a587"
        },
        {
          "url": "https://git.kernel.org/stable/c/b8afcf799b2cc92c41beebd029e53ed18960184a"
        },
        {
          "url": "https://git.kernel.org/stable/c/9a7b7248798123efbd5fafe58461d57c7cc718af"
        },
        {
          "url": "https://git.kernel.org/stable/c/7141990add3f75436f2933cb310654cad3b1e3e9"
        }
      ],
      "title": "batman-adv: access unicast_ttvn skb-\u003edata only after skb realloc",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-72234",
    "datePublished": "2026-08-15T05:54:24.395Z",
    "dateReserved": "2026-08-09T03:40:39.914Z",
    "dateUpdated": "2026-08-17T05:41:51.879Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-72234",
      "date": "2026-09-20",
      "epss": "0.00675",
      "percentile": "0.5075"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "net/batman-adv/routing.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "aa9558af859934f24717d4bab97d61004f91a736",
                    "status": "affected",
                    "version": "c018ad3de61a1dc4194879a53e5559e094aa7b1a",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "9c2c05629e46c1fd43931506d41c56a885a98eb4",
                    "status": "affected",
                    "version": "c018ad3de61a1dc4194879a53e5559e094aa7b1a",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "7b162b36de750565404cd3b98315706622c6974f",
                    "status": "affected",
                    "version": "c018ad3de61a1dc4194879a53e5559e094aa7b1a",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "ed90eb5c68420cdfe67ec1f773324198d2ef6f50",
                    "status": "affected",
                    "version": "c018ad3de61a1dc4194879a53e5559e094aa7b1a",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "979175834a699ccc3c4c0b0ba60ecae0f135a587",
                    "status": "affected",
                    "version": "c018ad3de61a1dc4194879a53e5559e094aa7b1a",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "b8afcf799b2cc92c41beebd029e53ed18960184a",
                    "status": "affected",
                    "version": "c018ad3de61a1dc4194879a53e5559e094aa7b1a",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "9a7b7248798123efbd5fafe58461d57c7cc718af",
                    "status": "affected",
                    "version": "c018ad3de61a1dc4194879a53e5559e094aa7b1a",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "7141990add3f75436f2933cb310654cad3b1e3e9",
                    "status": "affected",
                    "version": "c018ad3de61a1dc4194879a53e5559e094aa7b1a",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "net/batman-adv/routing.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "3.13"
                  },
                  {
                    "lessThan": "3.13",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.261",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.212",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.178",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.145",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.97",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.40",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.5",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbatman-adv: access unicast_ttvn skb-\u003edata only after skb realloc\n\nThe pskb_may_pull() called by batadv_get_vid() could reallocate the buffer\nbehind the skb. Variables which were pointing to the old buffer need to be\nreassigned to avoid an use-after-free.\n\nThis was done correctly for the ethernet header but missed for the\nunicast_packet pointer."
          }
        ],
        "id": "CVE-2026-72234",
        "lastModified": "2026-08-17T06:18:24.847",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 9.8,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-08-15T06:21:50.390",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/7141990add3f75436f2933cb310654cad3b1e3e9"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/7b162b36de750565404cd3b98315706622c6974f"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/979175834a699ccc3c4c0b0ba60ecae0f135a587"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/9a7b7248798123efbd5fafe58461d57c7cc718af"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/9c2c05629e46c1fd43931506d41c56a885a98eb4"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/aa9558af859934f24717d4bab97d61004f91a736"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/b8afcf799b2cc92c41beebd029e53ed18960184a"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/ed90eb5c68420cdfe67ec1f773324198d2ef6f50"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-18T17:32:45+00:00",
      "cve": "CVE-2026-72234",
      "id": "CVE-2026-72234",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: batman-adv: access unicast_ttvn skb-\u003edata only after skb realloc",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-72234.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-15T01:27:52Z",
      "cve": "CVE-2026-72234",
      "id": "CVE-2026-72234",
      "initial_release_date": "2026-08-21T00:42:17Z",
      "product_status:known_affected": "298",
      "product_status:known_not_affected": "64",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-72234",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-72234.json",
      "version": "4"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.