CVE-2026-72234
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
In the Linux kernel's batman-adv module, after pskb_may_pull() is called by batadv_get_vid(), the skb buffer may be reallocated. The unicast_packet pointer was not reassigned after this reallocation, potentially leading to a use-after-free.
Risk Assessment
An attacker could exploit this vulnerability to gain unauthorized access to kernel memory, potentially leading to privilege escalation or system crash.
Recommendation
Apply the Linux kernel update containing the fix for this vulnerability. Ensure systems are updated to the latest kernel version with security patches.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: batman-adv: access unicast_ttvn skb->data only after skb realloc The pskb_may_pull() called by batadv_get_vid() could reallocate the buffer behind the skb. Variables which were pointing to the old buffer need to be reassigned to avoid an use-after-free. This was done correctly for the ethernet header but missed for the unicast_packet pointer.