CVE-2026-52922

batman-adv: dat: handle forward allocation error

State: Published
Severity: 7.5 High
Published: Jun 24, 2026
Updated: Aug 5, 2026
Reserved: Jun 9, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

batman-adv: dat: handle forward allocation error

batadv_dat_forward_data() calls pskb_copy_for_clone() to duplicate an skb for each DHT candidate, but does not check the return value before passing it to batadv_send_skb_prepare_unicast_4addr(). That function dereferences the skb unconditionally, so a failed allocation triggers a NULL pointer dereference.

Skip forwarding to the current DHT candidate on allocation failure.

Scores

CVSS	Score	Vector	Source
3.1	7.5 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	785ea1144182c341b8b85b0f8180291839d176a8 to before 9bcebaedfb8479cb4affb23c7a0d000ca9a20e73Affected 785ea1144182c341b8b85b0f8180291839d176a8 to before 2edb8aeb3cdda9d00ec4997252dc5bcd6f54d8efAffected 785ea1144182c341b8b85b0f8180291839d176a8 to before ce0c381199402a2c58f4599f4f6ed100d872d0daAffected 785ea1144182c341b8b85b0f8180291839d176a8 to before 866ac1d57040ed0b44ca732e3c66b3aa6b93011cAffected 785ea1144182c341b8b85b0f8180291839d176a8 to before 4d420d9ee70a220a2cd95aa0dd2e15acad66a505Affected 785ea1144182c341b8b85b0f8180291839d176a8 to before 9cceea8eeba710def2a5707ee00f00c74a9a1cacAffected 785ea1144182c341b8b85b0f8180291839d176a8 to before cf48e75fc4fe0d5cc7721c82d454221d01367b93Affected 785ea1144182c341b8b85b0f8180291839d176a8 to before 2d8826a2d3657cea66fb0370f9e521575a673871Affected
LinuxLinux	3.8Affected before 3.8Not affected 5.10.258 through 5.10.Not affected 5.15.209 through 5.15.Not affected 6.1.175 through 6.1.Not affected 6.6.142 through 6.6.Not affected 6.12.92 through 6.12.Not affected 6.18.34 through 6.18.Not affected 7.0.11 through 7.0.*Not affected 7.1 and laterNot affected

Product

Versions

LinuxLinux

785ea1144182c341b8b85b0f8180291839d176a8 to before 9bcebaedfb8479cb4affb23c7a0d000ca9a20e73Affected
785ea1144182c341b8b85b0f8180291839d176a8 to before 2edb8aeb3cdda9d00ec4997252dc5bcd6f54d8efAffected
785ea1144182c341b8b85b0f8180291839d176a8 to before ce0c381199402a2c58f4599f4f6ed100d872d0daAffected
785ea1144182c341b8b85b0f8180291839d176a8 to before 866ac1d57040ed0b44ca732e3c66b3aa6b93011cAffected
785ea1144182c341b8b85b0f8180291839d176a8 to before 4d420d9ee70a220a2cd95aa0dd2e15acad66a505Affected
785ea1144182c341b8b85b0f8180291839d176a8 to before 9cceea8eeba710def2a5707ee00f00c74a9a1cacAffected
785ea1144182c341b8b85b0f8180291839d176a8 to before cf48e75fc4fe0d5cc7721c82d454221d01367b93Affected
785ea1144182c341b8b85b0f8180291839d176a8 to before 2d8826a2d3657cea66fb0370f9e521575a673871Affected

LinuxLinux

3.8Affected
before 3.8Not affected
5.10.258 through 5.10.*Not affected
5.15.209 through 5.15.*Not affected
6.1.175 through 6.1.*Not affected
6.6.142 through 6.6.*Not affected
6.12.92 through 6.12.*Not affected
6.18.34 through 6.18.*Not affected
7.0.11 through 7.0.*Not affected
7.1 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.