GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-72231 (GCVE-0-2026-72231)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:54 – Updated: 2026-08-17 05:41
VLAI
Title
batman-adv: tt: avoid request storms during pending request
Summary
In the Linux kernel, the following vulnerability has been resolved: batman-adv: tt: avoid request storms during pending request batadv_send_tt_request() allocates a tt_req_node when none exists for the destination originator node. This should prevent that a multiple TT requests are send at the same time to an originator. But if allocation of the send buffer failed, this request must be cleaned up again. But indicator for such a failure is "ret == false". But the actual implementation is checking for "ret == true". The check must be inverted to not loose the information about the TT request directly after it was attempted to be sent out. This should avoid potential request storms.
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 335fbe0f5d2501b7dd815806aef6fd9bad784eb1 , < 6055695ea40c64a47e00742c12c99b1a33b4daed (git)
Affected: 335fbe0f5d2501b7dd815806aef6fd9bad784eb1 , < 21c44a6895f41df811d1c91d10eea194dda2b345 (git)
Affected: 335fbe0f5d2501b7dd815806aef6fd9bad784eb1 , < 5e46c76d9a5062212c4c5f642a5549fd9c057f8a (git)
Affected: 335fbe0f5d2501b7dd815806aef6fd9bad784eb1 , < 067e413eec2e63c2996909ef55214b3a0eda0be7 (git)
Affected: 335fbe0f5d2501b7dd815806aef6fd9bad784eb1 , < 716f434eb35869e130424331584a91fbb729b9bd (git)
Affected: 335fbe0f5d2501b7dd815806aef6fd9bad784eb1 , < 6a65ac8a81e903bb4b555c1d13532f5cb0167a4a (git)
Affected: 335fbe0f5d2501b7dd815806aef6fd9bad784eb1 , < aba1cf21954e64c36afb966b754adad2b0b8aa48 (git)
Affected: 335fbe0f5d2501b7dd815806aef6fd9bad784eb1 , < 27c7d40008231ae4140d35501b60087a9de2d2c3 (git)
guessed Create a notification for this product.
Linux Linux Affected: 3.13
Unaffected: 0 , < 3.13 (semver)
Unaffected: 5.10.261 , ≤ 5.10.* (semver)
Unaffected: 5.15.212 , ≤ 5.15.* (semver)
Unaffected: 6.1.178 , ≤ 6.1.* (semver)
Unaffected: 6.6.145 , ≤ 6.6.* (semver)
Unaffected: 6.12.97 , ≤ 6.12.* (semver)
Unaffected: 6.18.40 , ≤ 6.18.* (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/batman-adv/translation-table.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6055695ea40c64a47e00742c12c99b1a33b4daed",
              "status": "affected",
              "version": "335fbe0f5d2501b7dd815806aef6fd9bad784eb1",
              "versionType": "git"
            },
            {
              "lessThan": "21c44a6895f41df811d1c91d10eea194dda2b345",
              "status": "affected",
              "version": "335fbe0f5d2501b7dd815806aef6fd9bad784eb1",
              "versionType": "git"
            },
            {
              "lessThan": "5e46c76d9a5062212c4c5f642a5549fd9c057f8a",
              "status": "affected",
              "version": "335fbe0f5d2501b7dd815806aef6fd9bad784eb1",
              "versionType": "git"
            },
            {
              "lessThan": "067e413eec2e63c2996909ef55214b3a0eda0be7",
              "status": "affected",
              "version": "335fbe0f5d2501b7dd815806aef6fd9bad784eb1",
              "versionType": "git"
            },
            {
              "lessThan": "716f434eb35869e130424331584a91fbb729b9bd",
              "status": "affected",
              "version": "335fbe0f5d2501b7dd815806aef6fd9bad784eb1",
              "versionType": "git"
            },
            {
              "lessThan": "6a65ac8a81e903bb4b555c1d13532f5cb0167a4a",
              "status": "affected",
              "version": "335fbe0f5d2501b7dd815806aef6fd9bad784eb1",
              "versionType": "git"
            },
            {
              "lessThan": "aba1cf21954e64c36afb966b754adad2b0b8aa48",
              "status": "affected",
              "version": "335fbe0f5d2501b7dd815806aef6fd9bad784eb1",
              "versionType": "git"
            },
            {
              "lessThan": "27c7d40008231ae4140d35501b60087a9de2d2c3",
              "status": "affected",
              "version": "335fbe0f5d2501b7dd815806aef6fd9bad784eb1",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/batman-adv/translation-table.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.13"
            },
            {
              "lessThan": "3.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.261",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbatman-adv: tt: avoid request storms during pending request\n\nbatadv_send_tt_request() allocates a tt_req_node when none exists for the\ndestination originator node. This should prevent that a multiple TT\nrequests are send at the same time to an originator.\n\nBut if allocation of the send buffer failed, this request must be cleaned\nup again. But indicator for such a failure is \"ret == false\". But the\nactual implementation is checking for \"ret == true\".\n\nThe check must be inverted to not loose the information about the TT\nrequest directly after it was attempted to be sent out. This should avoid\npotential request storms."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The bug is reached when remote batman-adv OGM/TVLV packets are received on an active mesh hardif via batadv_batman_skb_recv() \u2192 batadv_iv_ogm_recv() \u2192 batadv_tvlv_ogm_receive() \u2192 batadv_tt_update_orig() \u2192 batadv_send_tt_request(), with no local syscall required on the victim.\nAC:L - A mesh attacker can deterministically craft OGMs with mismatched TTVN/CRC to force the request_table path on every received OGM; the inverted ret check removes the pending tt_req_node after each successful send, eliminating deduplication so storms are repeatable without races.\nPR:N - batman-adv OGM/TVLV processing performs no authentication or capability check on senders; any mesh peer that can inject ETH_P_BATMAN frames onto the victim\u0027s active hardif triggers the vulnerable path without Linux credentials on the victim host.\nUI:N - No victim user action is required once batman-adv is active; the kernel automatically processes incoming OGMs and issues TT_REQUEST unicasts in response to detected translation-table inconsistency, entirely driven by attacker-supplied mesh traffic.\nS:U - Impact is confined to excessive batman-adv translation-table control traffic and resource exhaustion on the victim mesh node within the kernel networking stack; it does not cross VM, container, IOMMU, or other security authority boundaries.\nC:N - The inverted conditional is a pure logic error in tt_req_node list housekeeping; it causes neither out-of-bounds access, use-after-free, nor uninitialized data transmission, so no information-disclosure or memory-read primitive exists.\nI:N - No attacker-controlled kernel memory writes or data corruption occur; the bug only suppresses pending-request tracking so duplicate TT_REQUEST packets are emitted, flooding mesh bandwidth without modifying stored translation-table contents.\nA:H - Removing the tt_req_node immediately after each successful TT_REQUEST disables the one-request-per-originator guard, letting a remote attacker drive unbounded GFP_ATOMIC allocations and mesh-wide TT_REQUEST storms that can exhaust CPU, memory, and link capacity on community mesh nodes."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:41:48.586Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/6055695ea40c64a47e00742c12c99b1a33b4daed"
        },
        {
          "url": "https://git.kernel.org/stable/c/21c44a6895f41df811d1c91d10eea194dda2b345"
        },
        {
          "url": "https://git.kernel.org/stable/c/5e46c76d9a5062212c4c5f642a5549fd9c057f8a"
        },
        {
          "url": "https://git.kernel.org/stable/c/067e413eec2e63c2996909ef55214b3a0eda0be7"
        },
        {
          "url": "https://git.kernel.org/stable/c/716f434eb35869e130424331584a91fbb729b9bd"
        },
        {
          "url": "https://git.kernel.org/stable/c/6a65ac8a81e903bb4b555c1d13532f5cb0167a4a"
        },
        {
          "url": "https://git.kernel.org/stable/c/aba1cf21954e64c36afb966b754adad2b0b8aa48"
        },
        {
          "url": "https://git.kernel.org/stable/c/27c7d40008231ae4140d35501b60087a9de2d2c3"
        }
      ],
      "title": "batman-adv: tt: avoid request storms during pending request",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-72231",
    "datePublished": "2026-08-15T05:54:22.076Z",
    "dateReserved": "2026-08-09T03:40:39.913Z",
    "dateUpdated": "2026-08-17T05:41:48.586Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-72231",
      "date": "2026-09-04",
      "epss": "0.00677",
      "percentile": "0.49923"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-72231\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-15T06:21:50.000\",\"lastModified\":\"2026-08-17T06:18:24.377\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbatman-adv: tt: avoid request storms during pending request\\n\\nbatadv_send_tt_request() allocates a tt_req_node when none exists for the\\ndestination originator node. This should prevent that a multiple TT\\nrequests are send at the same time to an originator.\\n\\nBut if allocation of the send buffer failed, this request must be cleaned\\nup again. But indicator for such a failure is \\\"ret == false\\\". But the\\nactual implementation is checking for \\\"ret == true\\\".\\n\\nThe check must be inverted to not loose the information about the TT\\nrequest directly after it was attempted to be sent out. This should avoid\\npotential request storms.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/batman-adv/translation-table.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"335fbe0f5d2501b7dd815806aef6fd9bad784eb1\",\"lessThan\":\"6055695ea40c64a47e00742c12c99b1a33b4daed\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"335fbe0f5d2501b7dd815806aef6fd9bad784eb1\",\"lessThan\":\"21c44a6895f41df811d1c91d10eea194dda2b345\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"335fbe0f5d2501b7dd815806aef6fd9bad784eb1\",\"lessThan\":\"5e46c76d9a5062212c4c5f642a5549fd9c057f8a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"335fbe0f5d2501b7dd815806aef6fd9bad784eb1\",\"lessThan\":\"067e413eec2e63c2996909ef55214b3a0eda0be7\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"335fbe0f5d2501b7dd815806aef6fd9bad784eb1\",\"lessThan\":\"716f434eb35869e130424331584a91fbb729b9bd\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"335fbe0f5d2501b7dd815806aef6fd9bad784eb1\",\"lessThan\":\"6a65ac8a81e903bb4b555c1d13532f5cb0167a4a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"335fbe0f5d2501b7dd815806aef6fd9bad784eb1\",\"lessThan\":\"aba1cf21954e64c36afb966b754adad2b0b8aa48\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"335fbe0f5d2501b7dd815806aef6fd9bad784eb1\",\"lessThan\":\"27c7d40008231ae4140d35501b60087a9de2d2c3\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/batman-adv/translation-table.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"3.13\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"3.13\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.261\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.212\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.178\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.145\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.97\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.40\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.5\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/067e413eec2e63c2996909ef55214b3a0eda0be7\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/21c44a6895f41df811d1c91d10eea194dda2b345\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/27c7d40008231ae4140d35501b60087a9de2d2c3\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/5e46c76d9a5062212c4c5f642a5549fd9c057f8a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/6055695ea40c64a47e00742c12c99b1a33b4daed\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/6a65ac8a81e903bb4b555c1d13532f5cb0167a4a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/716f434eb35869e130424331584a91fbb729b9bd\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/aba1cf21954e64c36afb966b754adad2b0b8aa48\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-18T10:42:40+00:00",
      "cve": "CVE-2026-72231",
      "id": "CVE-2026-72231",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: batman-adv: tt: avoid request storms during pending request",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-72231.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.