CVE-2026-72233 (GCVE-0-2026-72233)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:54 – Updated: 2026-08-17 05:41
VLAI
Title
batman-adv: bla: reacquire gw address after skb realloc
Summary
In the Linux kernel, the following vulnerability has been resolved: batman-adv: bla: reacquire gw address after skb realloc The pskb_may_pull() called by batadv_bla_is_backbone_gw() could reallocate the buffer behind the skb. Variables which were pointing to the old buffer need to be reassigned to avoid an use-after-free.
Severity
8.8 (High)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 9e794b6bf4a2c65d698d7433ddfabc54a5d53a88 , < 41819c5467b6eb8ab4567f0ac98702ce9b6abbb1 (git)
Affected: 9e794b6bf4a2c65d698d7433ddfabc54a5d53a88 , < a9ab19fbca86b32e9a9ae9e1a63e70a7eab3400f (git)
Affected: 9e794b6bf4a2c65d698d7433ddfabc54a5d53a88 , < 4a6673c55752a7aa41e28f51660eb981504ca088 (git)
Affected: 9e794b6bf4a2c65d698d7433ddfabc54a5d53a88 , < ab2bac47a02637df1128a151e81d3ec14767f4bb (git)
Affected: 9e794b6bf4a2c65d698d7433ddfabc54a5d53a88 , < dc16bbf53cede1baf564bf0c8a861114b64e18b3 (git)
Affected: 9e794b6bf4a2c65d698d7433ddfabc54a5d53a88 , < e5e18886aadd3870e2d84e32a9678317fab1dd9e (git)
Affected: 9e794b6bf4a2c65d698d7433ddfabc54a5d53a88 , < f4fb97ecf677cd9c3aa4f3bfc6fbf5b0e4bdbbbf (git)
Affected: 9e794b6bf4a2c65d698d7433ddfabc54a5d53a88 , < cdf3b5af2bc4431e58629e8ad2086b1e9185c761 (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.12
Unaffected: 0 , < 4.12 (semver)
Unaffected: 5.10.261 , ≤ 5.10.* (semver)
Unaffected: 5.15.212 , ≤ 5.15.* (semver)
Unaffected: 6.1.178 , ≤ 6.1.* (semver)
Unaffected: 6.6.145 , ≤ 6.6.* (semver)
Unaffected: 6.12.97 , ≤ 6.12.* (semver)
Unaffected: 6.18.40 , ≤ 6.18.* (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/batman-adv/routing.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "41819c5467b6eb8ab4567f0ac98702ce9b6abbb1",
              "status": "affected",
              "version": "9e794b6bf4a2c65d698d7433ddfabc54a5d53a88",
              "versionType": "git"
            },
            {
              "lessThan": "a9ab19fbca86b32e9a9ae9e1a63e70a7eab3400f",
              "status": "affected",
              "version": "9e794b6bf4a2c65d698d7433ddfabc54a5d53a88",
              "versionType": "git"
            },
            {
              "lessThan": "4a6673c55752a7aa41e28f51660eb981504ca088",
              "status": "affected",
              "version": "9e794b6bf4a2c65d698d7433ddfabc54a5d53a88",
              "versionType": "git"
            },
            {
              "lessThan": "ab2bac47a02637df1128a151e81d3ec14767f4bb",
              "status": "affected",
              "version": "9e794b6bf4a2c65d698d7433ddfabc54a5d53a88",
              "versionType": "git"
            },
            {
              "lessThan": "dc16bbf53cede1baf564bf0c8a861114b64e18b3",
              "status": "affected",
              "version": "9e794b6bf4a2c65d698d7433ddfabc54a5d53a88",
              "versionType": "git"
            },
            {
              "lessThan": "e5e18886aadd3870e2d84e32a9678317fab1dd9e",
              "status": "affected",
              "version": "9e794b6bf4a2c65d698d7433ddfabc54a5d53a88",
              "versionType": "git"
            },
            {
              "lessThan": "f4fb97ecf677cd9c3aa4f3bfc6fbf5b0e4bdbbbf",
              "status": "affected",
              "version": "9e794b6bf4a2c65d698d7433ddfabc54a5d53a88",
              "versionType": "git"
            },
            {
              "lessThan": "cdf3b5af2bc4431e58629e8ad2086b1e9185c761",
              "status": "affected",
              "version": "9e794b6bf4a2c65d698d7433ddfabc54a5d53a88",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/batman-adv/routing.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.12"
            },
            {
              "lessThan": "4.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.261",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbatman-adv: bla: reacquire gw address after skb realloc\n\nThe pskb_may_pull() called by batadv_bla_is_backbone_gw() could reallocate\nthe buffer behind the skb. Variables which were pointing to the old buffer\nneed to be reassigned to avoid an use-after-free."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - The bug is hit in batadv_recv_unicast_packet() when batman-adv ETH_P_BATMAN frames are received on a mesh hard interface via batadv_batman_skb_recv(); exploitation requires a peer on the same wireless/bridged mesh segment (community, industrial, or gateway meshes), matching adjacent Wi-Fi/L2 reachability rather than arbitrary Internet routing.\nAC:L - An on-mesh attacker fully controls the injected unicast skb (headers, VLAN tagging) to make batadv_bla_is_backbone_gw()\u0027s pskb_may_pull() reallocate the buffer; this is a deterministic use-after-free with no victim-timed race or layout the attacker cannot influence by resending crafted frames.\nPR:N - No account or capability on the victim host is required; any unauthenticated mesh participant (or L2 source spoofer on the mesh/backbone) can send batman-adv unicast packets destined to the victim\u0027s MAC through the normal RX handler without local login or CAP_NET_ADMIN on the target.\nUI:N - The vulnerable path runs automatically in softirq when the mesh interface receives qualifying unicast traffic; the victim operator does not need to mount a filesystem, click a link, or perform any deliberate action beyond running an active batman-adv mesh with bridge loop avoidance enabled.\nS:U - Exploitation corrupts or reads kernel heap memory inside the batman-adv RX path on the same host; it does not cross a VM/hypervisor, container, or IOMMU security boundary to impact a different authority\u0027s resources.\nC:H - After pskb_may_pull() frees the old skb head, the stale orig_addr_gw pointer is read through %pM in batadv_dbg(), constituting a kernel slab use-after-free that can disclose adjacent freed-object contents and is scored as arbitrary-read class per UAF guidance.\nI:H - Use-after-free of skb linear data is heap memory corruption; even though the immediate stale access is for logging, UAF on RX skbs enables spray/reuse of the freed buffer for control of subsequent kernel objects and potential write primitives.\nA:H - Dereferencing a freed skb buffer in interrupt/RX context can trigger KASAN slab-use-after-free reports, kernel oops, or panic on affected builds; any exploitable UAF on the packet receive path is rated high availability impact."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:41:50.777Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/41819c5467b6eb8ab4567f0ac98702ce9b6abbb1"
        },
        {
          "url": "https://git.kernel.org/stable/c/a9ab19fbca86b32e9a9ae9e1a63e70a7eab3400f"
        },
        {
          "url": "https://git.kernel.org/stable/c/4a6673c55752a7aa41e28f51660eb981504ca088"
        },
        {
          "url": "https://git.kernel.org/stable/c/ab2bac47a02637df1128a151e81d3ec14767f4bb"
        },
        {
          "url": "https://git.kernel.org/stable/c/dc16bbf53cede1baf564bf0c8a861114b64e18b3"
        },
        {
          "url": "https://git.kernel.org/stable/c/e5e18886aadd3870e2d84e32a9678317fab1dd9e"
        },
        {
          "url": "https://git.kernel.org/stable/c/f4fb97ecf677cd9c3aa4f3bfc6fbf5b0e4bdbbbf"
        },
        {
          "url": "https://git.kernel.org/stable/c/cdf3b5af2bc4431e58629e8ad2086b1e9185c761"
        }
      ],
      "title": "batman-adv: bla: reacquire gw address after skb realloc",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-72233",
    "datePublished": "2026-08-15T05:54:23.663Z",
    "dateReserved": "2026-08-09T03:40:39.913Z",
    "dateUpdated": "2026-08-17T05:41:50.777Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-72233",
      "date": "2026-09-22",
      "epss": "0.00344",
      "percentile": "0.28046"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "net/batman-adv/routing.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "41819c5467b6eb8ab4567f0ac98702ce9b6abbb1",
                    "status": "affected",
                    "version": "9e794b6bf4a2c65d698d7433ddfabc54a5d53a88",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "a9ab19fbca86b32e9a9ae9e1a63e70a7eab3400f",
                    "status": "affected",
                    "version": "9e794b6bf4a2c65d698d7433ddfabc54a5d53a88",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "4a6673c55752a7aa41e28f51660eb981504ca088",
                    "status": "affected",
                    "version": "9e794b6bf4a2c65d698d7433ddfabc54a5d53a88",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "ab2bac47a02637df1128a151e81d3ec14767f4bb",
                    "status": "affected",
                    "version": "9e794b6bf4a2c65d698d7433ddfabc54a5d53a88",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "dc16bbf53cede1baf564bf0c8a861114b64e18b3",
                    "status": "affected",
                    "version": "9e794b6bf4a2c65d698d7433ddfabc54a5d53a88",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "e5e18886aadd3870e2d84e32a9678317fab1dd9e",
                    "status": "affected",
                    "version": "9e794b6bf4a2c65d698d7433ddfabc54a5d53a88",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "f4fb97ecf677cd9c3aa4f3bfc6fbf5b0e4bdbbbf",
                    "status": "affected",
                    "version": "9e794b6bf4a2c65d698d7433ddfabc54a5d53a88",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "cdf3b5af2bc4431e58629e8ad2086b1e9185c761",
                    "status": "affected",
                    "version": "9e794b6bf4a2c65d698d7433ddfabc54a5d53a88",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "net/batman-adv/routing.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "4.12"
                  },
                  {
                    "lessThan": "4.12",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.261",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.212",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.178",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.145",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.97",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.40",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.5",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbatman-adv: bla: reacquire gw address after skb realloc\n\nThe pskb_may_pull() called by batadv_bla_is_backbone_gw() could reallocate\nthe buffer behind the skb. Variables which were pointing to the old buffer\nneed to be reassigned to avoid an use-after-free."
          }
        ],
        "id": "CVE-2026-72233",
        "lastModified": "2026-08-17T06:18:24.693",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "ADJACENT_NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 8.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-08-15T06:21:50.253",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/41819c5467b6eb8ab4567f0ac98702ce9b6abbb1"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/4a6673c55752a7aa41e28f51660eb981504ca088"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/a9ab19fbca86b32e9a9ae9e1a63e70a7eab3400f"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/ab2bac47a02637df1128a151e81d3ec14767f4bb"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/cdf3b5af2bc4431e58629e8ad2086b1e9185c761"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/dc16bbf53cede1baf564bf0c8a861114b64e18b3"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/e5e18886aadd3870e2d84e32a9678317fab1dd9e"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/f4fb97ecf677cd9c3aa4f3bfc6fbf5b0e4bdbbbf"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-18T17:32:39+00:00",
      "cve": "CVE-2026-72233",
      "id": "CVE-2026-72233",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: batman-adv: bla: reacquire gw address after skb realloc",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-72233.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-31T16:26:48Z",
      "cve": "CVE-2026-72233",
      "id": "CVE-2026-72233",
      "initial_release_date": "2026-08-31T16:26:48Z",
      "product_status:known_affected": "315",
      "product_status:known_not_affected": "47",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-72233",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-72233.json",
      "version": "2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.