Look up another CVE · open CVE-2026-72227 in the interactive tracker
CVE-2026-72227
batman-adv: mcast: avoid OOB read of num_dests header
Published 2026-08-15 (2 months ago) by the Linux kernel CNA. Subsystem net/batman-adv. Debian urgency: unimportant.
What to do, per Debian release
Debian's own status for CVE-2026-72227 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | not affected | 6.1.190-1 | Nothing to do. bookworm never shipped the vulnerable code. |
| Debian 13trixie | fixed | 6.12.100-1 | Update the kernel and reboot. Fixed in 6.12.100-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 7.1.5-1 | Update the kernel and reboot. Fixed in 7.1.5-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.1.5-1 | Update the kernel and reboot. Fixed in 7.1.5-1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
Before the access to struct batadv_tvlv_mcast_tracker's num_dests, it is attempted to check whether enough space is actually in the network header. But instead of using offsetofend() to check for the whole size (2) which must be accessible, offsetof() of is called. The latter is always returning 0. The comparison with the network header length will always return that enough data is available - even when only 1 or 0 bytes are accessible. Instead of using offsetofend(), use the more common check for the whole header.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
net/batman-adv/multicast_forw.c
- What this is
- BATMAN ADVANCEDMAINTAINERS section matched on net/batman-adv/ · b.a.t.m.a.n@lists.open-mesh.org · Maintained
- Kernel module
- batman_adv
Check it on the machine
grep -wE 'CONFIG_BATMAN_ADV|CONFIG_BATMAN_ADV_MCAST' /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
lsmod | grep -w batman_advPrints a line if that module is loaded right now, and nothing if it is not. One that is not loaded can still be loaded later by anything that needs it.
Show whether Debian builds this, per release
Debian builds this, but not on every flavour. At least one release below builds the code on some of its kernel flavours and not on others, so the answer depends on the architecture and flavour installed. The build rule could not be established for 1 release, so nothing is claimed about those.
- bookworm?
- trixie, forky, sidMnot built on amd64/cloud-amd64, arm64/cloud-arm64
- ?
- not established - no Makefile entry for the affected file
- M
- a module where it is built at all; some flavours do not build it
Where a release above reads "not established", no build rule for the affected file was found in that release's kernel tree. That is a gap in this lookup, not a finding that the code is absent.
- Build switches
- CONFIG_BATMAN_ADV, CONFIG_BATMAN_ADV_MCAST
- Reads as
- all on means the file is compiled; any one off means it is not.
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-08-15 (2 months ago)source
- CVSS
- 8.1 high
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:Hsource recompute it - Attack vector
- adjacent network (AV:A)source
- EPSS
- 0.33%, higher than 24.7% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- unimportantsource
- Subsystem
- net/batman-adv
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 6.8 | 6.12.97 | 80f62893d135 |
| 6.8 | 6.18.40 | d2b657c9653f |
| 6.8 | 7.1.5 | 7d1a877670bc |
| 6.8 | 7.2 | 38eaed28e250 |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:AAttack vector, adjacent network
- Batman-adv receives ETH_P_BATMAN frames on mesh hard interfaces via batadv_batman_skb_recv(); an attacker must be on the same L2 broadcast/collision domain (WiFi/community mesh or shared Ethernet) to inject crafted BATADV_MCAST packets to a node's MAC.
- AC:LAttack complexity, low
- Exploitation is reliable: send a BATADV_MCAST packet whose MCAST_TRACKER TVLV has zero-byte content; offsetof() makes the bounds check always pass, so num_dests is read without races, rare kernel configs, or victim-specific state beyond an active mesh.
- PR:NPrivileges required, none
- No credentials or Linux privileges are required on the victim; any adjacent attacker who can transmit batman-adv Ethernet frames addressed to the target hard interface reaches batadv_recv_mcast_packet() and batadv_mcast_forw_tracker_tvlv_handler() with no authentication gate.
- UI:NUser interaction, none
- Triggering the bug requires only sending a malformed multicast packet; no victim interaction (mounts, clicks, or administrative steps) is needed beyond the mesh already running batman-adv with multicast optimization enabled.
- S:UScope, unchanged
- The flaw corrupts or reads kernel memory on the receiving mesh node only; it does not cross a security boundary such as a VM, container, or IOMMU isolation domain.
- C:HConfidentiality impact, high
- The broken offsetof() check allows a 2-byte out-of-bounds read of num_dests when the tracker TVLV content is shorter than the struct, disclosing adjacent skb tailroom or heap memory beyond the declared TVLV on minimally sized packets.
- I:NIntegrity impact, none
- This is an out-of-bounds read only; although num_dests may be taken from adjacent bytes, the follow-on tvlv_len check against skb_network_header_len() prevents destination iteration and forwarding, so no memory write or integrity modification occurs.
- A:HAvailability impact, high
- A minimally sized crafted packet can place the read past skb->tail when the MCAST_TRACKER TVLV has no payload, causing an out-of-bounds kernel access that may oops or panic the node and deny mesh service.