CVE-2026-72229

Received Received - Intake

Memory Leak in batman-adv Kernel Module

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: batman-adv: clean untagged VLAN on netdev registration failure When an mesh interface is registered, it creates an untagged struct batadv_meshif_vlan on top of it via the NETDEV_REGISTER notifier. But in this process, another receiver of this notification can veto the registration. The netdev registration will be aborted because of this veto. The register_netdevice() call will try to clean up the net_device using unregister_netdevice_queue() - which only uses the .priv_destructor to free private resources. In this situation, .dellink will not be called. The cleanup of the untagged batadv_meshif_vlan must thefore be done in the destructor to avoid a leak of this object.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-72229

EUVD

EUVD-2026-59128

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a memory leak in the batman-adv module. When a mesh interface registration fails due to a veto from another receiver, the cleanup process does not properly free an untagged VLAN object because the .dellink function is not called during cleanup. The destructor must handle this cleanup to prevent the leak.

Detection Guidance

This vulnerability is specific to the Linux kernel's batman-adv module and involves a VLAN cleanup issue during netdev registration failure. Detection requires checking for kernel logs or system errors related to batman-adv or VLAN handling during network interface registration.

Impact Analysis

This vulnerability could lead to memory leaks in systems running affected versions of the Linux kernel with batman-adv enabled. Over time, this may cause resource exhaustion, system instability, or crashes due to unmanaged memory usage.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or other common standards and regulations. It is a Linux kernel issue related to memory management during network interface registration failure, which does not involve data breaches or unauthorized access.

Mitigation Strategies

Update the Linux kernel to the latest stable version that includes the fix for CVE-2026-72229. Monitor for batman-adv related errors in system logs after applying the update.

Hi! I’m here to help you understand CVE-2026-72229. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70