GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-72227 (GCVE-0-2026-72227)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:54 – Updated: 2026-08-17 05:41
VLAI
Title
batman-adv: mcast: avoid OOB read of num_dests header
Summary
In the Linux kernel, the following vulnerability has been resolved: batman-adv: mcast: avoid OOB read of num_dests header Before the access to struct batadv_tvlv_mcast_tracker's num_dests, it is attempted to check whether enough space is actually in the network header. But instead of using offsetofend() to check for the whole size (2) which must be accessible, offsetof() of is called. The latter is always returning 0. The comparison with the network header length will always return that enough data is available - even when only 1 or 0 bytes are accessible. Instead of using offsetofend(), use the more common check for the whole header.
Severity
8.1 (High)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 07afe1ba288c04280622fa002ed385f1ac0b6fe6 , < 80f62893d135f415e7a374dd47b468ec298f7aed (git)
Affected: 07afe1ba288c04280622fa002ed385f1ac0b6fe6 , < d2b657c9653fcebca828a2ead13f444e0da68817 (git)
Affected: 07afe1ba288c04280622fa002ed385f1ac0b6fe6 , < 7d1a877670bc2e901241073f022ca8d1b2f85f1c (git)
Affected: 07afe1ba288c04280622fa002ed385f1ac0b6fe6 , < 38eaed28e250895d56f4b7989bd65479a511c5c3 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.8
Unaffected: 0 , < 6.8 (semver)
Unaffected: 6.12.97 , ≤ 6.12.* (semver)
Unaffected: 6.18.40 , ≤ 6.18.* (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/batman-adv/multicast_forw.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "80f62893d135f415e7a374dd47b468ec298f7aed",
              "status": "affected",
              "version": "07afe1ba288c04280622fa002ed385f1ac0b6fe6",
              "versionType": "git"
            },
            {
              "lessThan": "d2b657c9653fcebca828a2ead13f444e0da68817",
              "status": "affected",
              "version": "07afe1ba288c04280622fa002ed385f1ac0b6fe6",
              "versionType": "git"
            },
            {
              "lessThan": "7d1a877670bc2e901241073f022ca8d1b2f85f1c",
              "status": "affected",
              "version": "07afe1ba288c04280622fa002ed385f1ac0b6fe6",
              "versionType": "git"
            },
            {
              "lessThan": "38eaed28e250895d56f4b7989bd65479a511c5c3",
              "status": "affected",
              "version": "07afe1ba288c04280622fa002ed385f1ac0b6fe6",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/batman-adv/multicast_forw.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.8"
            },
            {
              "lessThan": "6.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbatman-adv: mcast: avoid OOB read of num_dests header\n\nBefore the access to struct batadv_tvlv_mcast_tracker\u0027s num_dests, it is\nattempted to check whether enough space is actually in the network header.\nBut instead of using offsetofend() to check for the whole size (2) which\nmust be accessible, offsetof() of is called. The latter is always returning\n0. The comparison with the network header length will always return that\nenough data is available - even when only 1 or 0 bytes are accessible.\n\nInstead of using offsetofend(), use the more common check for the whole\nheader."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - Batman-adv receives ETH_P_BATMAN frames on mesh hard interfaces via batadv_batman_skb_recv(); an attacker must be on the same L2 broadcast/collision domain (WiFi/community mesh or shared Ethernet) to inject crafted BATADV_MCAST packets to a node\u0027s MAC.\nAC:L - Exploitation is reliable: send a BATADV_MCAST packet whose MCAST_TRACKER TVLV has zero-byte content; offsetof() makes the bounds check always pass, so num_dests is read without races, rare kernel configs, or victim-specific state beyond an active mesh.\nPR:N - No credentials or Linux privileges are required on the victim; any adjacent attacker who can transmit batman-adv Ethernet frames addressed to the target hard interface reaches batadv_recv_mcast_packet() and batadv_mcast_forw_tracker_tvlv_handler() with no authentication gate.\nUI:N - Triggering the bug requires only sending a malformed multicast packet; no victim interaction (mounts, clicks, or administrative steps) is needed beyond the mesh already running batman-adv with multicast optimization enabled.\nS:U - The flaw corrupts or reads kernel memory on the receiving mesh node only; it does not cross a security boundary such as a VM, container, or IOMMU isolation domain.\nC:H - The broken offsetof() check allows a 2-byte out-of-bounds read of num_dests when the tracker TVLV content is shorter than the struct, disclosing adjacent skb tailroom or heap memory beyond the declared TVLV on minimally sized packets.\nI:N - This is an out-of-bounds read only; although num_dests may be taken from adjacent bytes, the follow-on tvlv_len check against skb_network_header_len() prevents destination iteration and forwarding, so no memory write or integrity modification occurs.\nA:H - A minimally sized crafted packet can place the read past skb-\u003etail when the MCAST_TRACKER TVLV has no payload, causing an out-of-bounds kernel access that may oops or panic the node and deny mesh service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:41:47.496Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/80f62893d135f415e7a374dd47b468ec298f7aed"
        },
        {
          "url": "https://git.kernel.org/stable/c/d2b657c9653fcebca828a2ead13f444e0da68817"
        },
        {
          "url": "https://git.kernel.org/stable/c/7d1a877670bc2e901241073f022ca8d1b2f85f1c"
        },
        {
          "url": "https://git.kernel.org/stable/c/38eaed28e250895d56f4b7989bd65479a511c5c3"
        }
      ],
      "title": "batman-adv: mcast: avoid OOB read of num_dests header",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-72227",
    "datePublished": "2026-08-15T05:54:19.020Z",
    "dateReserved": "2026-08-09T03:40:39.913Z",
    "dateUpdated": "2026-08-17T05:41:47.496Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-72227",
      "date": "2026-09-04",
      "epss": "0.00331",
      "percentile": "0.25805"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-72227\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-15T06:21:49.510\",\"lastModified\":\"2026-08-17T06:18:23.910\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbatman-adv: mcast: avoid OOB read of num_dests header\\n\\nBefore the access to struct batadv_tvlv_mcast_tracker\u0027s num_dests, it is\\nattempted to check whether enough space is actually in the network header.\\nBut instead of using offsetofend() to check for the whole size (2) which\\nmust be accessible, offsetof() of is called. The latter is always returning\\n0. The comparison with the network header length will always return that\\nenough data is available - even when only 1 or 0 bytes are accessible.\\n\\nInstead of using offsetofend(), use the more common check for the whole\\nheader.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/batman-adv/multicast_forw.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"07afe1ba288c04280622fa002ed385f1ac0b6fe6\",\"lessThan\":\"80f62893d135f415e7a374dd47b468ec298f7aed\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"07afe1ba288c04280622fa002ed385f1ac0b6fe6\",\"lessThan\":\"d2b657c9653fcebca828a2ead13f444e0da68817\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"07afe1ba288c04280622fa002ed385f1ac0b6fe6\",\"lessThan\":\"7d1a877670bc2e901241073f022ca8d1b2f85f1c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"07afe1ba288c04280622fa002ed385f1ac0b6fe6\",\"lessThan\":\"38eaed28e250895d56f4b7989bd65479a511c5c3\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/batman-adv/multicast_forw.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.8\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.8\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.97\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.40\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.5\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H\",\"baseScore\":8.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"ADJACENT_NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.2}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/38eaed28e250895d56f4b7989bd65479a511c5c3\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/7d1a877670bc2e901241073f022ca8d1b2f85f1c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/80f62893d135f415e7a374dd47b468ec298f7aed\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/d2b657c9653fcebca828a2ead13f444e0da68817\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-18T16:54:09+00:00",
      "cve": "CVE-2026-72227",
      "id": "CVE-2026-72227",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: batman-adv: mcast: avoid OOB read of num_dests header",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-72227.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.