CVE-2026-72231
Received Received - Intake

BaseFortify

Publication date: 2026-08-15

Last updated on: 2026-08-15

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: batman-adv: tt: avoid request storms during pending request batadv_send_tt_request() allocates a tt_req_node when none exists for the destination originator node. This should prevent that a multiple TT requests are send at the same time to an originator. But if allocation of the send buffer failed, this request must be cleaned up again. But indicator for such a failure is "ret == false". But the actual implementation is checking for "ret == true". The check must be inverted to not loose the information about the TT request directly after it was attempted to be sent out. This should avoid potential request storms.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-15
Last Modified
2026-08-15
Generated
2026-08-15
AI Q&A
2026-08-15
EPSS Evaluated
N/A
NVD
CVE-2026-72231
EUVD
EUVD-2026-59130

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a logic error in the batman-adv protocol. When sending a translation table request, the system allocates a request node to prevent duplicate requests. However, if the send buffer allocation fails, the code incorrectly checks for a success condition (ret == true) instead of a failure (ret == false). This causes the system to lose track of the failed request, potentially leading to repeated attempts and a request storm.

Detection Guidance

This vulnerability is specific to the Linux kernel's batman-adv module and involves a logic error in handling TT requests. Detection requires checking kernel logs for related errors or unusual TT request patterns. No direct commands are provided in the context, but monitoring batman-adv logs for failed TT request allocations or storms may indicate exploitation.

Impact Analysis

This vulnerability could cause network performance issues by generating excessive translation table requests. In severe cases, it may lead to network congestion or temporary unavailability of routing services in systems using batman-adv for mesh networking.

Mitigation Strategies

Update the Linux kernel to a patched version where this issue is resolved. The vulnerability is fixed by correcting the logic error in batadv_send_tt_request(). Check your distribution's security advisories for kernel updates addressing CVE-2026-72231.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-72231. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart