CVE-2026-72234

Received Received - Intake

BaseFortify

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: batman-adv: access unicast_ttvn skb->data only after skb realloc The pskb_may_pull() called by batadv_get_vid() could reallocate the buffer behind the skb. Variables which were pointing to the old buffer need to be reassigned to avoid an use-after-free. This was done correctly for the ethernet header but missed for the unicast_packet pointer.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-10-14

AI Q&A

2026-08-15

EPSS Evaluated

2026-10-13

NVD

CVE-2026-72234

EUVD

EUVD-2026-59133

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	c018ad3de61a1dc4194879a53e5559e094aa7b1a
Linux	Linux	c018ad3de61a1dc4194879a53e5559e094aa7b1a
Linux	Linux	c018ad3de61a1dc4194879a53e5559e094aa7b1a
Linux	Linux	c018ad3de61a1dc4194879a53e5559e094aa7b1a
Linux	Linux	c018ad3de61a1dc4194879a53e5559e094aa7b1a
Linux	Linux	c018ad3de61a1dc4194879a53e5559e094aa7b1a
Linux	Linux	c018ad3de61a1dc4194879a53e5559e094aa7b1a
Linux	Linux	c018ad3de61a1dc4194879a53e5559e094aa7b1a
Linux	Linux	3.13

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a use-after-free issue in the batman-adv protocol. The pskb_may_pull() function may reallocate the buffer for an skb (socket buffer), but the unicast_packet pointer was not reassigned after this reallocation. This leads to accessing freed memory, causing a use-after-free vulnerability.

Detection Guidance

This vulnerability is specific to the Linux kernel's batman-adv module and involves a use-after-free issue due to incorrect pointer reassignment after buffer reallocation. Detection requires checking for kernel logs or crashes related to batman-adv module usage.

Impact Analysis

This vulnerability could allow an attacker to execute arbitrary code or cause a denial of service by triggering the use-after-free condition. It may lead to system crashes or unauthorized access if exploited.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it pertains to a memory management issue in the Linux kernel's batman-adv module. No evidence suggests it impacts data protection, privacy, or security controls required by these regulations.

Mitigation Strategies

Update the Linux kernel to the latest patched version to resolve the batman-adv use-after-free vulnerability. Monitor kernel security advisories for patches addressing this issue.

Hi! I’m here to help you understand CVE-2026-72234. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70