In the Linux kernel, the following vulnerability has been resolved:

batman-adv: access unicast_ttvn skb->data only after skb realloc

The pskb_may_pull() called by batadv_get_vid() could reallocate the buffer
behind the skb. Variables which were pointing to the old buffer need to be
reassigned to avoid an use-after-free.

This was done correctly for the ethernet header but missed for the
unicast_packet pointer.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Linux Linux unaffected
Version Status Constraints
c018ad3de61a1dc4194879a53e5559e094aa7b1a affected < aa9558af859934f24717d4bab97d61004f91a736
c018ad3de61a1dc4194879a53e5559e094aa7b1a affected < 9c2c05629e46c1fd43931506d41c56a885a98eb4
c018ad3de61a1dc4194879a53e5559e094aa7b1a affected < 7b162b36de750565404cd3b98315706622c6974f
c018ad3de61a1dc4194879a53e5559e094aa7b1a affected < ed90eb5c68420cdfe67ec1f773324198d2ef6f50
c018ad3de61a1dc4194879a53e5559e094aa7b1a affected < 979175834a699ccc3c4c0b0ba60ecae0f135a587
c018ad3de61a1dc4194879a53e5559e094aa7b1a affected < b8afcf799b2cc92c41beebd029e53ed18960184a
c018ad3de61a1dc4194879a53e5559e094aa7b1a affected < 9a7b7248798123efbd5fafe58461d57c7cc718af
c018ad3de61a1dc4194879a53e5559e094aa7b1a affected < 7141990add3f75436f2933cb310654cad3b1e3e9
Linux Linux affected
Version Status Constraints
3.13 affected —
0 unaffected < 3.13
5.10.261 unaffected ≤ 5.10.*
5.15.212 unaffected ≤ 5.15.*
6.1.178 unaffected ≤ 6.1.*
6.6.145 unaffected ≤ 6.6.*
6.12.97 unaffected ≤ 6.12.*
6.18.40 unaffected ≤ 6.18.*
7.1.5 unaffected ≤ 7.1.*
7.2-rc2 unaffected ≤ *

No data.

No data.

No data.

Project Subscriptions

Vendors Products
Linux Subscribe
Linux Kernel Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/7141990add3f75436f2933cb310654cad3b1e3e9 cve-icon cve-icon
https://git.kernel.org/stable/c/7b162b36de750565404cd3b98315706622c6974f cve-icon cve-icon
https://git.kernel.org/stable/c/979175834a699ccc3c4c0b0ba60ecae0f135a587 cve-icon cve-icon
https://git.kernel.org/stable/c/9a7b7248798123efbd5fafe58461d57c7cc718af cve-icon cve-icon
https://git.kernel.org/stable/c/9c2c05629e46c1fd43931506d41c56a885a98eb4 cve-icon cve-icon
https://git.kernel.org/stable/c/aa9558af859934f24717d4bab97d61004f91a736 cve-icon cve-icon
https://git.kernel.org/stable/c/b8afcf799b2cc92c41beebd029e53ed18960184a cve-icon cve-icon
https://git.kernel.org/stable/c/ed90eb5c68420cdfe67ec1f773324198d2ef6f50 cve-icon cve-icon
History

Sat, 15 Aug 2026 06:00:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: batman-adv: access unicast_ttvn skb->data only after skb realloc The pskb_may_pull() called by batadv_get_vid() could reallocate the buffer behind the skb. Variables which were pointing to the old buffer need to be reassigned to avoid an use-after-free. This was done correctly for the ethernet header but missed for the unicast_packet pointer.
Title batman-adv: access unicast_ttvn skb->data only after skb realloc
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-08-15T05:54:24.395Z

Reserved: 2026-08-09T03:40:39.914Z

Link: CVE-2026-72234

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-15T06:21:50.390

Modified: 2026-08-15T06:21:50.390

Link: CVE-2026-72234

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses

No weakness.