CVE-2026-72227
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
In the Linux kernel's batman-adv module, when checking data availability for the num_dests field in struct batadv_tvlv_mcast_tracker, offsetof() is used instead of offsetofend(), which always returns 0. This causes the check to always pass, even when only 0 or 1 bytes are available, leading to an out-of-bounds read.
Risk Assessment
The vulnerability could allow an attacker to read data outside the buffer, potentially leading to information disclosure or system crash.
Recommendation
Install the Linux kernel patch that uses offsetofend() for proper size checking. Restrict network access for unauthorized users.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: batman-adv: mcast: avoid OOB read of num_dests header Before the access to struct batadv_tvlv_mcast_tracker's num_dests, it is attempted to check whether enough space is actually in the network header. But instead of using offsetofend() to check for the whole size (2) which must be accessible, offsetof() of is called. The latter is always returning 0. The comparison with the network header length will always return that enough data is available - even when only 1 or 0 bytes are accessible. Instead of using offsetofend(), use the more common check for the whole header.