Skip to content
CVE PROGRAM SOURCE RECORD8.8 High

CVE-2026-72235

batman-adv: retrieve ethhdr after potential skb realloc on RX

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: batman-adv: retrieve ethhdr after potential skb realloc on RX pskb_may_pull() in batadv_interface_rx() could reallocate the buffer behind the skb. Variables which were pointing to the old buffer need to be reassigned to avoid an use-after-free. This was done correctly for the VLAN header but missed for the ethernet header which is later used for the TT and AP isolation handling.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • c6c8fea29769d998d94fcec9b9f14d4b52b349d3 to < 6e189f14d1ea28db212b9d70a02131a7ce518012affected
  • c6c8fea29769d998d94fcec9b9f14d4b52b349d3 to < a1820344b180cb55af748f102bc536b5c93164dbaffected
  • c6c8fea29769d998d94fcec9b9f14d4b52b349d3 to < 6abf73589bed3f27ee240c08108feb72bed0b9c6affected
  • c6c8fea29769d998d94fcec9b9f14d4b52b349d3 to < f19259395b44af67f3c274e34237c295b526b859affected
  • c6c8fea29769d998d94fcec9b9f14d4b52b349d3 to < 2cefa5141cab8ec1e4b24cf585958b13f2e3049daffected
  • c6c8fea29769d998d94fcec9b9f14d4b52b349d3 to < 85a71a81854e0e191ad0e533eabb4eff54866febaffected
  • c6c8fea29769d998d94fcec9b9f14d4b52b349d3 to < b031fc97e1993d29d6c3a0e86a99140528cf31e8affected
  • c6c8fea29769d998d94fcec9b9f14d4b52b349d3 to < 035e1fed892d3d06002a73ff73668f618a514644affected

Linux Linux

Default version status: affected

  • 2.6.38affected
  • 0 to < 2.6.38unaffected
  • 5.10.261 to ≤ 5.10.*unaffected
  • 5.15.212 to ≤ 5.15.*unaffected
  • 6.1.178 to ≤ 6.1.*unaffected
  • 6.6.145 to ≤ 6.6.*unaffected
  • 6.12.97 to ≤ 6.12.*unaffected
  • 6.18.40 to ≤ 6.18.*unaffected
  • 7.1.5 to ≤ 7.1.*unaffected
  • 7.2 to ≤ *unaffected

References