Look up another CVE · open CVE-2026-72233 in the interactive tracker
CVE-2026-72233
batman-adv: bla: reacquire gw address after skb realloc
Published 2026-08-15 (2 months ago) by the Linux kernel CNA. Subsystem net/batman-adv. Debian urgency: not yet assigned.
What to do, per Debian release
Debian's own status for CVE-2026-72233 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | fixed | 6.1.180-1 | Update the kernel and reboot. Fixed in 6.1.180-1. A running kernel keeps the old code until the machine restarts. |
| Debian 13trixie | fixed | 6.12.100-1 | Update the kernel and reboot. Fixed in 6.12.100-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 7.1.5-1 | Update the kernel and reboot. Fixed in 7.1.5-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.1.5-1 | Update the kernel and reboot. Fixed in 7.1.5-1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
The pskb_may_pull() called by batadv_bla_is_backbone_gw() could reallocate the buffer behind the skb. Variables which were pointing to the old buffer need to be reassigned to avoid an use-after-free.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
net/batman-adv/routing.c
- What this is
- BATMAN ADVANCEDMAINTAINERS section matched on net/batman-adv/ · b.a.t.m.a.n@lists.open-mesh.org · Maintained
- Kernel module
- batman_adv
Check it on the machine
grep -w CONFIG_BATMAN_ADV /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
lsmod | grep -w batman_advPrints a line if that module is loaded right now, and nothing if it is not. One that is not loaded can still be loaded later by anything that needs it.
Show whether Debian builds this, per release
Debian builds this, but not on every flavour. At least one release below builds the code on some of its kernel flavours and not on others, so the answer depends on the architecture and flavour installed.
- bookworm, trixie, forky, sidMnot built on amd64/cloud-amd64, arm64/cloud-arm64
- M
- a module where it is built at all; some flavours do not build it
- Build switch
- CONFIG_BATMAN_ADV
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-08-15 (2 months ago)source
- CVSS
- 8.8 high
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- adjacent network (AV:A)source
- EPSS
- 0.34%, higher than 26.4% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- not yet assignedsource
- Subsystem
- net/batman-adv
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 4.12 | 5.10.261 | 41819c5467b6 |
| 4.12 | 5.15.212 | a9ab19fbca86 |
| 4.12 | 6.1.178 | 4a6673c55752 |
| 4.12 | 6.6.145 | ab2bac47a026 |
| 4.12 | 6.12.97 | dc16bbf53ced |
| 4.12 | 6.18.40 | e5e18886aadd |
| 4.12 | 7.1.5 | f4fb97ecf677 |
| 4.12 | 7.2 | cdf3b5af2bc4 |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:AAttack vector, adjacent network
- The bug is hit in batadv_recv_unicast_packet() when batman-adv ETH_P_BATMAN frames are received on a mesh hard interface via batadv_batman_skb_recv(); exploitation requires a peer on the same wireless/bridged mesh segment (community, industrial, or gateway meshes), matching adjacent Wi-Fi/L2 reachability rather than arbitrary Internet routing.
- AC:LAttack complexity, low
- An on-mesh attacker fully controls the injected unicast skb (headers, VLAN tagging) to make batadv_bla_is_backbone_gw()'s pskb_may_pull() reallocate the buffer; this is a deterministic use-after-free with no victim-timed race or layout the attacker cannot influence by resending crafted frames.
- PR:NPrivileges required, none
- No account or capability on the victim host is required; any unauthenticated mesh participant (or L2 source spoofer on the mesh/backbone) can send batman-adv unicast packets destined to the victim's MAC through the normal RX handler without local login or CAP_NET_ADMIN on the target.
- UI:NUser interaction, none
- The vulnerable path runs automatically in softirq when the mesh interface receives qualifying unicast traffic; the victim operator does not need to mount a filesystem, click a link, or perform any deliberate action beyond running an active batman-adv mesh with bridge loop avoidance enabled.
- S:UScope, unchanged
- Exploitation corrupts or reads kernel heap memory inside the batman-adv RX path on the same host; it does not cross a VM/hypervisor, container, or IOMMU security boundary to impact a different authority's resources.
- C:HConfidentiality impact, high
- After pskb_may_pull() frees the old skb head, the stale orig_addr_gw pointer is read through %pM in batadv_dbg(), constituting a kernel slab use-after-free that can disclose adjacent freed-object contents and is scored as arbitrary-read class per UAF guidance.
- I:HIntegrity impact, high
- Use-after-free of skb linear data is heap memory corruption; even though the immediate stale access is for logging, UAF on RX skbs enables spray/reuse of the freed buffer for control of subsequent kernel objects and potential write primitives.
- A:HAvailability impact, high
- Dereferencing a freed skb buffer in interrupt/RX context can trigger KASAN slab-use-after-free reports, kernel oops, or panic on affected builds; any exploitable UAF on the packet receive path is rated high availability impact.