CVE-2026-80599

Received Received - Intake

Out-of-Bounds Access in Linux Kernel batman-adv

Publication date: 2026-08-28

Last updated on: 2026-08-29

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: batman-adv: dat: ensure accessible eth_hdr proto field When batadv_get_vid() accesses the proto field of the ethernet header, it is not checking if the data itself is accessible. The caller is responsible for it. But in contrast to other call sites, batadv_dat_get_vid() and its caller didn't make sure this is true. This could have caused an out-of-bounds access.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-28

Last Modified

2026-08-29

Generated

2026-09-17

AI Q&A

2026-08-28

EPSS Evaluated

2026-09-15

NVD

CVE-2026-80599

EUVD

EUVD-2026-67475

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a Linux kernel vulnerability in the batman-adv module where the proto field of an ethernet header is accessed without verifying if the data is accessible. This could lead to an out-of-bounds memory access.

Detection Guidance

This vulnerability is specific to the Linux kernel's batman-adv module. Detection requires checking if the affected kernel module is loaded and inspecting kernel logs for related errors. Use commands like 'lsmod | grep batman_adv' to check if the module is loaded and 'dmesg | grep batadv' to search for kernel messages related to this issue.

Impact Analysis

This vulnerability could cause system crashes, data corruption, or potential privilege escalation if exploited. It may lead to instability in systems running affected Linux kernel versions.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA. It is a low-level kernel issue involving out-of-bounds access in the batman-adv module, which could lead to system instability or crashes but does not involve data exposure or privacy violations.

Mitigation Strategies

Immediately update your Linux kernel to a patched version that includes the fix for CVE-2026-80599. If updating is not immediately possible, consider unloading the batman-adv module with 'rmmod batman_adv' to prevent potential exploitation until a patch is applied.

Hi! I’m here to help you understand CVE-2026-80599. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70