CVE-2026-72234 batman-adv: access unicast_ttvn skb->data only after skb realloc

🗓️ 15 Aug 2026 05:54:24Reported by LinuxType

Use-after-free in batman-adv via stale unicast_packet pointer after skb realloc in batadv_get_vid().

Reporter	Title	Published	Views	Family All 6
CVE	CVE-2026-72234	15 Aug 202605:54	–	cve
Debian CVE	CVE-2026-72234	15 Aug 202605:54	–	debiancve
EUVD	EUVD-2026-59133	15 Aug 202605:54	–	euvd
NVD	CVE-2026-72234	15 Aug 202606:21	–	nvd
OSV	DEBIAN-CVE-2026-72234	15 Aug 202606:21	–	osv
Positive Technologies	PT-2026-72422	15 Aug 202600:00	–	ptsecurity

[
  {
    "product": "Linux",
    "vendor": "Linux",
    "defaultStatus": "unaffected",
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "programFiles": [
      "net/batman-adv/routing.c"
    ],
    "versions": [
      {
        "version": "c018ad3de61a1dc4194879a53e5559e094aa7b1a",
        "lessThan": "aa9558af859934f24717d4bab97d61004f91a736",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "c018ad3de61a1dc4194879a53e5559e094aa7b1a",
        "lessThan": "9c2c05629e46c1fd43931506d41c56a885a98eb4",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "c018ad3de61a1dc4194879a53e5559e094aa7b1a",
        "lessThan": "7b162b36de750565404cd3b98315706622c6974f",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "c018ad3de61a1dc4194879a53e5559e094aa7b1a",
        "lessThan": "ed90eb5c68420cdfe67ec1f773324198d2ef6f50",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "c018ad3de61a1dc4194879a53e5559e094aa7b1a",
        "lessThan": "979175834a699ccc3c4c0b0ba60ecae0f135a587",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "c018ad3de61a1dc4194879a53e5559e094aa7b1a",
        "lessThan": "b8afcf799b2cc92c41beebd029e53ed18960184a",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "c018ad3de61a1dc4194879a53e5559e094aa7b1a",
        "lessThan": "9a7b7248798123efbd5fafe58461d57c7cc718af",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "c018ad3de61a1dc4194879a53e5559e094aa7b1a",
        "lessThan": "7141990add3f75436f2933cb310654cad3b1e3e9",
        "status": "affected",
        "versionType": "git"
      }
    ]
  },
  {
    "product": "Linux",
    "vendor": "Linux",
    "defaultStatus": "affected",
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "programFiles": [
      "net/batman-adv/routing.c"
    ],
    "versions": [
      {
        "version": "3.13",
        "status": "affected"
      },
      {
        "version": "0",
        "lessThan": "3.13",
        "status": "unaffected",
        "versionType": "semver"
      },
      {
        "version": "5.10.261",
        "lessThanOrEqual": "5.10.*",
        "status": "unaffected",
        "versionType": "semver"
      },
      {
        "version": "5.15.212",
        "lessThanOrEqual": "5.15.*",
        "status": "unaffected",
        "versionType": "semver"
      },
      {
        "version": "6.1.178",
        "lessThanOrEqual": "6.1.*",
        "status": "unaffected",
        "versionType": "semver"
      },
      {
        "version": "6.6.145",
        "lessThanOrEqual": "6.6.*",
        "status": "unaffected",
        "versionType": "semver"
      },
      {
        "version": "6.12.97",
        "lessThanOrEqual": "6.12.*",
        "status": "unaffected",
        "versionType": "semver"
      },
      {
        "version": "6.18.40",
        "lessThanOrEqual": "6.18.*",
        "status": "unaffected",
        "versionType": "semver"
      },
      {
        "version": "7.1.5",
        "lessThanOrEqual": "7.1.*",
        "status": "unaffected",
        "versionType": "semver"
      },
      {
        "version": "7.2-rc2",
        "lessThanOrEqual": "*",
        "status": "unaffected",
        "versionType": "original_commit_for_fix"
      }
    ]
  }
]

Source	Link
git	www.git.kernel.org/stable/c/aa9558af859934f24717d4bab97d61004f91a736
git	www.git.kernel.org/stable/c/9a7b7248798123efbd5fafe58461d57c7cc718af
git	www.git.kernel.org/stable/c/b8afcf799b2cc92c41beebd029e53ed18960184a
git	www.git.kernel.org/stable/c/7141990add3f75436f2933cb310654cad3b1e3e9
git	www.git.kernel.org/stable/c/979175834a699ccc3c4c0b0ba60ecae0f135a587
git	www.git.kernel.org/stable/c/7b162b36de750565404cd3b98315706622c6974f
git	www.git.kernel.org/stable/c/9c2c05629e46c1fd43931506d41c56a885a98eb4
git	www.git.kernel.org/stable/c/ed90eb5c68420cdfe67ec1f773324198d2ef6f50

15 Aug 2026 05:54Current

EPSS0.0022