{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2026-72227", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-09T03:40:39.913Z", "datePublished": "2026-08-15T05:54:19.020Z", "dateUpdated": "2026-08-17T05:41:47.496Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-17T05:41:47.496Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbatman-adv: mcast: avoid OOB read of num_dests header\n\nBefore the access to struct batadv_tvlv_mcast_tracker's num_dests, it is\nattempted to check whether enough space is actually in the network header.\nBut instead of using offsetofend() to check for the whole size (2) which\nmust be accessible, offsetof() of is called. The latter is always returning\n0. The comparison with the network header length will always return that\nenough data is available - even when only 1 or 0 bytes are accessible.\n\nInstead of using offsetofend(), use the more common check for the whole\nheader." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "baseScore": 8.1, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:A - Batman-adv receives ETH_P_BATMAN frames on mesh hard interfaces via batadv_batman_skb_recv(); an attacker must be on the same L2 broadcast/collision domain (WiFi/community mesh or shared Ethernet) to inject crafted BATADV_MCAST packets to a node's MAC.\nAC:L - Exploitation is reliable: send a BATADV_MCAST packet whose MCAST_TRACKER TVLV has zero-byte content; offsetof() makes the bounds check always pass, so num_dests is read without races, rare kernel configs, or victim-specific state beyond an active mesh.\nPR:N - No credentials or Linux privileges are required on the victim; any adjacent attacker who can transmit batman-adv Ethernet frames addressed to the target hard interface reaches batadv_recv_mcast_packet() and batadv_mcast_forw_tracker_tvlv_handler() with no authentication gate.\nUI:N - Triggering the bug requires only sending a malformed multicast packet; no victim interaction (mounts, clicks, or administrative steps) is needed beyond the mesh already running batman-adv with multicast optimization enabled.\nS:U - The flaw corrupts or reads kernel memory on the receiving mesh node only; it does not cross a security boundary such as a VM, container, or IOMMU isolation domain.\nC:H - The broken offsetof() check allows a 2-byte out-of-bounds read of num_dests when the tracker TVLV content is shorter than the struct, disclosing adjacent skb tailroom or heap memory beyond the declared TVLV on minimally sized packets.\nI:N - This is an out-of-bounds read only; although num_dests may be taken from adjacent bytes, the follow-on tvlv_len check against skb_network_header_len() prevents destination iteration and forwarding, so no memory write or integrity modification occurs.\nA:H - A minimally sized crafted packet can place the read past skb->tail when the MCAST_TRACKER TVLV has no payload, causing an out-of-bounds kernel access that may oops or panic the node and deny mesh service." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "net/batman-adv/multicast_forw.c" ], "versions": [ { "version": "07afe1ba288c04280622fa002ed385f1ac0b6fe6", "lessThan": "80f62893d135f415e7a374dd47b468ec298f7aed", "status": "affected", "versionType": "git" }, { "version": "07afe1ba288c04280622fa002ed385f1ac0b6fe6", "lessThan": "d2b657c9653fcebca828a2ead13f444e0da68817", "status": "affected", "versionType": "git" }, { "version": "07afe1ba288c04280622fa002ed385f1ac0b6fe6", "lessThan": "7d1a877670bc2e901241073f022ca8d1b2f85f1c", "status": "affected", "versionType": "git" }, { "version": "07afe1ba288c04280622fa002ed385f1ac0b6fe6", "lessThan": "38eaed28e250895d56f4b7989bd65479a511c5c3", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "net/batman-adv/multicast_forw.c" ], "versions": [ { "version": "6.8", "status": "affected" }, { "version": "0", "lessThan": "6.8", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.97", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.18.40", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.1.5", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.8", "versionEndExcluding": "6.12.97" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.8", "versionEndExcluding": "6.18.40" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.8", "versionEndExcluding": "7.1.5" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.8", "versionEndExcluding": "7.2" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/80f62893d135f415e7a374dd47b468ec298f7aed" }, { "url": "https://git.kernel.org/stable/c/d2b657c9653fcebca828a2ead13f444e0da68817" }, { "url": "https://git.kernel.org/stable/c/7d1a877670bc2e901241073f022ca8d1b2f85f1c" }, { "url": "https://git.kernel.org/stable/c/38eaed28e250895d56f4b7989bd65479a511c5c3" } ], "title": "batman-adv: mcast: avoid OOB read of num_dests header", "x_generator": { "engine": "bippy-1.2.0" } } } }