CVE-2026-80599

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:AAttack vector, adjacent network

Exploitation requires injecting crafted ETH_P_BATMAN frames on the victim's batman-adv hard interface via batadv_batman_skb_recv(); an attacker must be on the same L2 mesh segment (WiFi community mesh, industrial mesh, or shared Ethernet backbone), not arbitrary Internet routing.

AC:LAttack complexity, low

The attacker fully controls remote packet length and contents; sending a batman-adv unicast or broadcast frame with only the batman header (10 or 14 bytes) and no embedded Ethernet payload bypasses hdr_size-only pskb_may_pull checks and deterministically forces the h_proto read past skb->tail without races or rare configuration.

PR:NPrivileges required, none

No Linux account or capability on the victim is required; any unauthenticated mesh peer that can transmit ETH_P_BATMAN frames to an active batman-adv node with Distributed ARP Table enabled reaches batadv_dat_snoop_incoming_*() through the normal RX handler without local login or CAP_NET_ADMIN on the target.

UI:NUser interaction, none

The vulnerable path runs automatically in softirq when the mesh interface receives qualifying traffic; no victim mount, click, or administrative action is needed beyond batman-adv already running with DAT enabled (the default at mesh interface creation).

S:UScope, unchanged

Impact is an out-of-bounds kernel read during batman-adv packet processing on the receiving mesh node; it does not cross a VM, container, or IOMMU security boundary to affect a different authority's resources.

C:HConfidentiality impact, high

batadv_get_vid() reads ethhdr->h_proto (2 bytes at offset 12 within the embedded Ethernet header) without ensuring hdr_size+ETH_HLEN bytes are accessible, causing an out-of-bounds read of adjacent skb tailroom or slab memory beyond the packet buffer per kernel OOB-read guidance.

I:NIntegrity impact, none

This is an out-of-bounds read only with no memory write or corruption; subsequent batadv_arp_get_type() performs its own pskb_may_pull() before further parsing, and the DAT snoop path returns without modifying kernel structures beyond the illicit read.

A:HAvailability impact, high

Reading past skb->tail in NET_RX_SOFTIRQ can provoke a kernel oops or panic when the access crosses an unmapped page boundary, denying mesh and host connectivity; any out-of-bounds kernel access on the packet receive path is rated high availability impact.