CVE-2026-72226
Received Received - Intake

BaseFortify

Publication date: 2026-08-15

Last updated on: 2026-08-15

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: batman-adv: tt: prevent TVLV OOB check overflow A TT unicast TVLV contains the number of VLANs stored in it. This number is an u16 and gets multiplied by the size of the struct batadv_tvlv_tt_vlan_data (8 bytes). The size can therefore overflow the u16 used to store the tt_vlan_len. All additional safety checks to prevent out-of-bounds access of the TVLV buffer are invalid due to this overflow. Using size_t prevents this overflow and ensures that the safety checks compare against the actual buffer requirements.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-15
Last Modified
2026-08-15
Generated
2026-08-15
AI Q&A
2026-08-15
EPSS Evaluated
N/A
NVD
CVE-2026-72226
EUVD
EUVD-2026-59125

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a potential overflow in the batman-adv protocol's TT unicast TVLV handling. The issue occurs when the number of VLANs, stored as a u16, is multiplied by the size of batadv_tvlv_tt_vlan_data (8 bytes). This multiplication can overflow the u16 used for tt_vlan_len, leading to incorrect buffer size calculations and potential out-of-bounds access in the TVLV buffer.

Detection Guidance

This vulnerability affects the Linux kernel's batman-adv module. Detection requires checking if your system uses a vulnerable kernel version with batman-adv enabled. Inspect kernel logs for batman-adv related errors or run 'dmesg | grep batman-adv' to check for module activity.

Impact Analysis

This vulnerability could allow an attacker to cause a denial of service or potentially execute arbitrary code by sending maliciously crafted network packets. Systems running affected versions of the Linux kernel with batman-adv enabled may be vulnerable to crashes or unauthorized access.

Mitigation Strategies

Update your Linux kernel to a patched version that includes the fix for this batman-adv vulnerability. Disable the batman-adv module if not in use. Monitor kernel security advisories for updates.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-72226. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart