CVE-2026-72235
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
In the Linux kernel batman-adv, a use-after-free issue was found due to potential buffer reallocation by pskb_may_pull() in batadv_interface_rx(). The fix reassigns the ethernet header pointer after reallocation.
Risk Assessment
Use-after-free could lead to system crashes or potential code execution, posing a serious security threat.
Recommendation
It is recommended to update the Linux kernel to a version containing the fix and monitor systems using batman-adv.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: batman-adv: retrieve ethhdr after potential skb realloc on RX pskb_may_pull() in batadv_interface_rx() could reallocate the buffer behind the skb. Variables which were pointing to the old buffer need to be reassigned to avoid an use-after-free. This was done correctly for the VLAN header but missed for the ethernet header which is later used for the TT and AP isolation handling.