CVE-2026-72233

batman-adv: bla: reacquire gw address after skb realloc

State: Published
Severity: 8.8 High
Published: Aug 15, 2026
Updated: Oct 16, 2026
Reserved: Aug 9, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

batman-adv: bla: reacquire gw address after skb realloc

The pskb_may_pull() called by batadv_bla_is_backbone_gw() could reallocate the buffer behind the skb. Variables which were pointing to the old buffer need to be reassigned to avoid an use-after-free.

Scores

CVSS	Score	Vector	Source
3.1	8.8 High	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	9e794b6bf4a2c65d698d7433ddfabc54a5d53a88 to before 41819c5467b6eb8ab4567f0ac98702ce9b6abbb1Affected 9e794b6bf4a2c65d698d7433ddfabc54a5d53a88 to before a9ab19fbca86b32e9a9ae9e1a63e70a7eab3400fAffected 9e794b6bf4a2c65d698d7433ddfabc54a5d53a88 to before 4a6673c55752a7aa41e28f51660eb981504ca088Affected 9e794b6bf4a2c65d698d7433ddfabc54a5d53a88 to before ab2bac47a02637df1128a151e81d3ec14767f4bbAffected 9e794b6bf4a2c65d698d7433ddfabc54a5d53a88 to before dc16bbf53cede1baf564bf0c8a861114b64e18b3Affected 9e794b6bf4a2c65d698d7433ddfabc54a5d53a88 to before e5e18886aadd3870e2d84e32a9678317fab1dd9eAffected 9e794b6bf4a2c65d698d7433ddfabc54a5d53a88 to before f4fb97ecf677cd9c3aa4f3bfc6fbf5b0e4bdbbbfAffected 9e794b6bf4a2c65d698d7433ddfabc54a5d53a88 to before cdf3b5af2bc4431e58629e8ad2086b1e9185c761Affected
LinuxLinux	4.12Affected before 4.12Not affected 5.10.261 through 5.10.Not affected 5.15.212 through 5.15.Not affected 6.1.178 through 6.1.Not affected 6.6.145 through 6.6.Not affected 6.12.97 through 6.12.Not affected 6.18.40 through 6.18.Not affected 7.1.5 through 7.1.*Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

9e794b6bf4a2c65d698d7433ddfabc54a5d53a88 to before 41819c5467b6eb8ab4567f0ac98702ce9b6abbb1Affected
9e794b6bf4a2c65d698d7433ddfabc54a5d53a88 to before a9ab19fbca86b32e9a9ae9e1a63e70a7eab3400fAffected
9e794b6bf4a2c65d698d7433ddfabc54a5d53a88 to before 4a6673c55752a7aa41e28f51660eb981504ca088Affected
9e794b6bf4a2c65d698d7433ddfabc54a5d53a88 to before ab2bac47a02637df1128a151e81d3ec14767f4bbAffected
9e794b6bf4a2c65d698d7433ddfabc54a5d53a88 to before dc16bbf53cede1baf564bf0c8a861114b64e18b3Affected
9e794b6bf4a2c65d698d7433ddfabc54a5d53a88 to before e5e18886aadd3870e2d84e32a9678317fab1dd9eAffected
9e794b6bf4a2c65d698d7433ddfabc54a5d53a88 to before f4fb97ecf677cd9c3aa4f3bfc6fbf5b0e4bdbbbfAffected
9e794b6bf4a2c65d698d7433ddfabc54a5d53a88 to before cdf3b5af2bc4431e58629e8ad2086b1e9185c761Affected

LinuxLinux

4.12Affected
before 4.12Not affected
5.10.261 through 5.10.*Not affected
5.15.212 through 5.15.*Not affected
6.1.178 through 6.1.*Not affected
6.6.145 through 6.6.*Not affected
6.12.97 through 6.12.*Not affected
6.18.40 through 6.18.*Not affected
7.1.5 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.