CVE-2026-72235

CVE-2026-72235

High · published August 15, 2026

CVSS v3.1
8.8
EPSS
0%
Percentile
26.7
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

batman-adv: retrieve ethhdr after potential skb realloc on RX

pskb_may_pull() in batadv_interface_rx() could reallocate the buffer behind

the skb. Variables which were pointing to the old buffer need to be

reassigned to avoid an use-after-free.

This was done correctly for the VLAN header but missed for the ethernet

header which is later used for the TT and AP isolation handling.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00344 · 26.7th percentile
Published
2026-08-15T10:21Z
References (8)
https://git.kernel.org/stable/c/035e1fed892d3d06002a73ff73668f618a514644 · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/2cefa5141cab8ec1e4b24cf585958b13f2e3049d · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/6abf73589bed3f27ee240c08108feb72bed0b9c6 · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/6e189f14d1ea28db212b9d70a02131a7ce518012 · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/85a71a81854e0e191ad0e533eabb4eff54866feb · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/a1820344b180cb55af748f102bc536b5c93164db · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/b031fc97e1993d29d6c3a0e86a99140528cf31e8 · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/f19259395b44af67f3c274e34237c295b526b859 · 416baaa9-dc9f-4396-8d5f-8c081fb06d67
EPSS history
Timeline
  • 15 AUG 05:54Z
    batman-adv: retrieve ethhdr after potential skb realloc on RX
    cvelistv5