CVE-2026-72232
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
In the Linux kernel's batman-adv module, the function batadv_interface_tx() assumes that at least ETH_HLEN bytes are available but does not check this itself. A local user with eBPF TC hook access can truncate the packet and redirect it to a batadv interface, potentially leading to an out-of-bounds read.
Risk Assessment
A local attacker could exploit this vulnerability to read data outside the buffer, potentially leading to information disclosure or system crash.
Recommendation
Apply the Linux kernel patch that adds proper ethernet header length checking in batadv_interface_tx(). Restrict eBPF TC hook access for unauthorized users.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: batman-adv: ensure minimal ethernet header on TX As documented in commit 8bd67ebb50c0 ("net: bridge: xmit: make sure we have at least eth header len bytes"), it is possible by for a local user with eBPF TC hook access to attach a tc filter which truncates the packet and redirects to an batadv interface. But the code assumes that at least ETH_HLEN bytes are available and thus might read outside of the available buffer. The batadv_interface_tx() must therefore always check itself if enough data is available for the ethernet header and don't rely on min_header_len.