CVE-2026-72235

batman-adv: retrieve ethhdr after potential skb realloc on RX

State: Published
Severity: 8.8 High
Published: Aug 15, 2026
Updated: Oct 16, 2026
Reserved: Aug 9, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

batman-adv: retrieve ethhdr after potential skb realloc on RX

pskb_may_pull() in batadv_interface_rx() could reallocate the buffer behind the skb. Variables which were pointing to the old buffer need to be reassigned to avoid an use-after-free.

This was done correctly for the VLAN header but missed for the ethernet header which is later used for the TT and AP isolation handling.

Scores

CVSS	Score	Vector	Source
3.1	8.8 High	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	c6c8fea29769d998d94fcec9b9f14d4b52b349d3 to before 6e189f14d1ea28db212b9d70a02131a7ce518012Affected c6c8fea29769d998d94fcec9b9f14d4b52b349d3 to before a1820344b180cb55af748f102bc536b5c93164dbAffected c6c8fea29769d998d94fcec9b9f14d4b52b349d3 to before 6abf73589bed3f27ee240c08108feb72bed0b9c6Affected c6c8fea29769d998d94fcec9b9f14d4b52b349d3 to before f19259395b44af67f3c274e34237c295b526b859Affected c6c8fea29769d998d94fcec9b9f14d4b52b349d3 to before 2cefa5141cab8ec1e4b24cf585958b13f2e3049dAffected c6c8fea29769d998d94fcec9b9f14d4b52b349d3 to before 85a71a81854e0e191ad0e533eabb4eff54866febAffected c6c8fea29769d998d94fcec9b9f14d4b52b349d3 to before b031fc97e1993d29d6c3a0e86a99140528cf31e8Affected c6c8fea29769d998d94fcec9b9f14d4b52b349d3 to before 035e1fed892d3d06002a73ff73668f618a514644Affected
LinuxLinux	2.6.38Affected before 2.6.38Not affected 5.10.261 through 5.10.Not affected 5.15.212 through 5.15.Not affected 6.1.178 through 6.1.Not affected 6.6.145 through 6.6.Not affected 6.12.97 through 6.12.Not affected 6.18.40 through 6.18.Not affected 7.1.5 through 7.1.*Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

c6c8fea29769d998d94fcec9b9f14d4b52b349d3 to before 6e189f14d1ea28db212b9d70a02131a7ce518012Affected
c6c8fea29769d998d94fcec9b9f14d4b52b349d3 to before a1820344b180cb55af748f102bc536b5c93164dbAffected
c6c8fea29769d998d94fcec9b9f14d4b52b349d3 to before 6abf73589bed3f27ee240c08108feb72bed0b9c6Affected
c6c8fea29769d998d94fcec9b9f14d4b52b349d3 to before f19259395b44af67f3c274e34237c295b526b859Affected
c6c8fea29769d998d94fcec9b9f14d4b52b349d3 to before 2cefa5141cab8ec1e4b24cf585958b13f2e3049dAffected
c6c8fea29769d998d94fcec9b9f14d4b52b349d3 to before 85a71a81854e0e191ad0e533eabb4eff54866febAffected
c6c8fea29769d998d94fcec9b9f14d4b52b349d3 to before b031fc97e1993d29d6c3a0e86a99140528cf31e8Affected
c6c8fea29769d998d94fcec9b9f14d4b52b349d3 to before 035e1fed892d3d06002a73ff73668f618a514644Affected

LinuxLinux

2.6.38Affected
before 2.6.38Not affected
5.10.261 through 5.10.*Not affected
5.15.212 through 5.15.*Not affected
6.1.178 through 6.1.*Not affected
6.6.145 through 6.6.*Not affected
6.12.97 through 6.12.*Not affected
6.18.40 through 6.18.*Not affected
7.1.5 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.