CVE-2026-80600

batman-adv: dat: acquire ARP hw source only after skb realloc

State: Published
Severity: 9.8 Critical
Published: Aug 28, 2026
Updated: Aug 29, 2026
Reserved: Aug 26, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

batman-adv: dat: acquire ARP hw source only after skb realloc

The pskb_may_pull() called by batadv_get_vid() could reallocate the buffer behind the skb. Variables which were pointing to the old buffer need to be reassigned to avoid an use-after-free.

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	b61ec31c85756bbc898fb892555509afe709459a to before a82fc217cb7a447313c76ebf9f09b100771b0ddfAffected b61ec31c85756bbc898fb892555509afe709459a to before 86aa79b43e5b561fd3648891165bd7313b541315Affected b61ec31c85756bbc898fb892555509afe709459a to before d755cd001fa2c248e186c1fc3df3d11d97dc843cAffected b61ec31c85756bbc898fb892555509afe709459a to before 3404be97b940a9b1ae1aea5fdbc6cdbbe9cd5146Affected b61ec31c85756bbc898fb892555509afe709459a to before 01678c53a7717a748aee388b6839e7b9761d641cAffected b61ec31c85756bbc898fb892555509afe709459a to before 3b4c70c40f2e135a50cd38fc61c7d23a296a9981Affected b61ec31c85756bbc898fb892555509afe709459a to before 059a70e1d12d6d99310e0599d37b0323557569a8Affected b61ec31c85756bbc898fb892555509afe709459a to before 48067b2ae4504500a7093d9e1e16b42e70330480Affected
LinuxLinux	5.1Affected before 5.1Not affected 5.10.261 through 5.10.Not affected 5.15.212 through 5.15.Not affected 6.1.178 through 6.1.Not affected 6.6.145 through 6.6.Not affected 6.12.97 through 6.12.Not affected 6.18.40 through 6.18.Not affected 7.1.5 through 7.1.*Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

b61ec31c85756bbc898fb892555509afe709459a to before a82fc217cb7a447313c76ebf9f09b100771b0ddfAffected
b61ec31c85756bbc898fb892555509afe709459a to before 86aa79b43e5b561fd3648891165bd7313b541315Affected
b61ec31c85756bbc898fb892555509afe709459a to before d755cd001fa2c248e186c1fc3df3d11d97dc843cAffected
b61ec31c85756bbc898fb892555509afe709459a to before 3404be97b940a9b1ae1aea5fdbc6cdbbe9cd5146Affected
b61ec31c85756bbc898fb892555509afe709459a to before 01678c53a7717a748aee388b6839e7b9761d641cAffected
b61ec31c85756bbc898fb892555509afe709459a to before 3b4c70c40f2e135a50cd38fc61c7d23a296a9981Affected
b61ec31c85756bbc898fb892555509afe709459a to before 059a70e1d12d6d99310e0599d37b0323557569a8Affected
b61ec31c85756bbc898fb892555509afe709459a to before 48067b2ae4504500a7093d9e1e16b42e70330480Affected

LinuxLinux

5.1Affected
before 5.1Not affected
5.10.261 through 5.10.*Not affected
5.15.212 through 5.15.*Not affected
6.1.178 through 6.1.*Not affected
6.6.145 through 6.6.*Not affected
6.12.97 through 6.12.*Not affected
6.18.40 through 6.18.*Not affected
7.1.5 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.