CVE-2026-80599 (GCVE-0-2026-80599)

Vulnerability from cvelistv5 – Published: 2026-08-28 06:48 – Updated: 2026-08-29 06:21
VLAI
Title
batman-adv: dat: ensure accessible eth_hdr proto field
Summary
In the Linux kernel, the following vulnerability has been resolved: batman-adv: dat: ensure accessible eth_hdr proto field When batadv_get_vid() accesses the proto field of the ethernet header, it is not checking if the data itself is accessible. The caller is responsible for it. But in contrast to other call sites, batadv_dat_get_vid() and its caller didn't make sure this is true. This could have caused an out-of-bounds access.
Severity
8.1 (High)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: be1db4f6615b5e6156c807ea8985171c215c2d57 , < da3677b5ed362742d30ceab31bfafcdc74dc2642 (git)
Affected: be1db4f6615b5e6156c807ea8985171c215c2d57 , < 6d3ea37074bb747f745d28138f87745ba9bd97c5 (git)
Affected: be1db4f6615b5e6156c807ea8985171c215c2d57 , < 7913935d41f166c367bbf7cc76a79e50044388e8 (git)
Affected: be1db4f6615b5e6156c807ea8985171c215c2d57 , < 3c62694c31f043568c3f4784b8d247cc3bea6b4c (git)
Affected: be1db4f6615b5e6156c807ea8985171c215c2d57 , < 5836a050d02e9598fa0f71e88dde28b63dfa35e3 (git)
Affected: be1db4f6615b5e6156c807ea8985171c215c2d57 , < 8f76277d02176cd739945bba3379448e2e22e799 (git)
Affected: be1db4f6615b5e6156c807ea8985171c215c2d57 , < 4407ff3af469356f9641c4a6e7072309bae86bea (git)
Affected: be1db4f6615b5e6156c807ea8985171c215c2d57 , < 26560c4a03dc4d607331600c187f59ab2df5f341 (git)
guessed Create a notification for this product.
Linux Linux Affected: 3.13
Unaffected: 0 , < 3.13 (semver)
Unaffected: 5.10.261 , ≤ 5.10.* (semver)
Unaffected: 5.15.212 , ≤ 5.15.* (semver)
Unaffected: 6.1.178 , ≤ 6.1.* (semver)
Unaffected: 6.6.145 , ≤ 6.6.* (semver)
Unaffected: 6.12.97 , ≤ 6.12.* (semver)
Unaffected: 6.18.40 , ≤ 6.18.* (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/batman-adv/distributed-arp-table.c",
            "net/batman-adv/main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "da3677b5ed362742d30ceab31bfafcdc74dc2642",
              "status": "affected",
              "version": "be1db4f6615b5e6156c807ea8985171c215c2d57",
              "versionType": "git"
            },
            {
              "lessThan": "6d3ea37074bb747f745d28138f87745ba9bd97c5",
              "status": "affected",
              "version": "be1db4f6615b5e6156c807ea8985171c215c2d57",
              "versionType": "git"
            },
            {
              "lessThan": "7913935d41f166c367bbf7cc76a79e50044388e8",
              "status": "affected",
              "version": "be1db4f6615b5e6156c807ea8985171c215c2d57",
              "versionType": "git"
            },
            {
              "lessThan": "3c62694c31f043568c3f4784b8d247cc3bea6b4c",
              "status": "affected",
              "version": "be1db4f6615b5e6156c807ea8985171c215c2d57",
              "versionType": "git"
            },
            {
              "lessThan": "5836a050d02e9598fa0f71e88dde28b63dfa35e3",
              "status": "affected",
              "version": "be1db4f6615b5e6156c807ea8985171c215c2d57",
              "versionType": "git"
            },
            {
              "lessThan": "8f76277d02176cd739945bba3379448e2e22e799",
              "status": "affected",
              "version": "be1db4f6615b5e6156c807ea8985171c215c2d57",
              "versionType": "git"
            },
            {
              "lessThan": "4407ff3af469356f9641c4a6e7072309bae86bea",
              "status": "affected",
              "version": "be1db4f6615b5e6156c807ea8985171c215c2d57",
              "versionType": "git"
            },
            {
              "lessThan": "26560c4a03dc4d607331600c187f59ab2df5f341",
              "status": "affected",
              "version": "be1db4f6615b5e6156c807ea8985171c215c2d57",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/batman-adv/distributed-arp-table.c",
            "net/batman-adv/main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.13"
            },
            {
              "lessThan": "3.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.261",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbatman-adv: dat: ensure accessible eth_hdr proto field\n\nWhen batadv_get_vid() accesses the proto field of the ethernet header, it\nis not checking if the data itself is accessible. The caller is responsible\nfor it. But in contrast to other call sites, batadv_dat_get_vid() and its\ncaller didn\u0027t make sure this is true. This could have caused an\nout-of-bounds access."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - Exploitation requires injecting crafted ETH_P_BATMAN frames on the victim\u0027s batman-adv hard interface via batadv_batman_skb_recv(); an attacker must be on the same L2 mesh segment (WiFi community mesh, industrial mesh, or shared Ethernet backbone), not arbitrary Internet routing.\nAC:L - The attacker fully controls remote packet length and contents; sending a batman-adv unicast or broadcast frame with only the batman header (10 or 14 bytes) and no embedded Ethernet payload bypasses hdr_size-only pskb_may_pull checks and deterministically forces the h_proto read past skb-\u003etail without races or rare configuration.\nPR:N - No Linux account or capability on the victim is required; any unauthenticated mesh peer that can transmit ETH_P_BATMAN frames to an active batman-adv node with Distributed ARP Table enabled reaches batadv_dat_snoop_incoming_*() through the normal RX handler without local login or CAP_NET_ADMIN on the target.\nUI:N - The vulnerable path runs automatically in softirq when the mesh interface receives qualifying traffic; no victim mount, click, or administrative action is needed beyond batman-adv already running with DAT enabled (the default at mesh interface creation).\nS:U - Impact is an out-of-bounds kernel read during batman-adv packet processing on the receiving mesh node; it does not cross a VM, container, or IOMMU security boundary to affect a different authority\u0027s resources.\nC:H - batadv_get_vid() reads ethhdr-\u003eh_proto (2 bytes at offset 12 within the embedded Ethernet header) without ensuring hdr_size+ETH_HLEN bytes are accessible, causing an out-of-bounds read of adjacent skb tailroom or slab memory beyond the packet buffer per kernel OOB-read guidance.\nI:N - This is an out-of-bounds read only with no memory write or corruption; subsequent batadv_arp_get_type() performs its own pskb_may_pull() before further parsing, and the DAT snoop path returns without modifying kernel structures beyond the illicit read.\nA:H - Reading past skb-\u003etail in NET_RX_SOFTIRQ can provoke a kernel oops or panic when the access crosses an unmapped page boundary, denying mesh and host connectivity; any out-of-bounds kernel access on the packet receive path is rated high availability impact."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-29T06:21:11.082Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/da3677b5ed362742d30ceab31bfafcdc74dc2642"
        },
        {
          "url": "https://git.kernel.org/stable/c/6d3ea37074bb747f745d28138f87745ba9bd97c5"
        },
        {
          "url": "https://git.kernel.org/stable/c/7913935d41f166c367bbf7cc76a79e50044388e8"
        },
        {
          "url": "https://git.kernel.org/stable/c/3c62694c31f043568c3f4784b8d247cc3bea6b4c"
        },
        {
          "url": "https://git.kernel.org/stable/c/5836a050d02e9598fa0f71e88dde28b63dfa35e3"
        },
        {
          "url": "https://git.kernel.org/stable/c/8f76277d02176cd739945bba3379448e2e22e799"
        },
        {
          "url": "https://git.kernel.org/stable/c/4407ff3af469356f9641c4a6e7072309bae86bea"
        },
        {
          "url": "https://git.kernel.org/stable/c/26560c4a03dc4d607331600c187f59ab2df5f341"
        }
      ],
      "title": "batman-adv: dat: ensure accessible eth_hdr proto field",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-80599",
    "datePublished": "2026-08-28T06:48:26.709Z",
    "dateReserved": "2026-08-26T14:34:25.771Z",
    "dateUpdated": "2026-08-29T06:21:11.082Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-80599",
      "date": "2026-09-01",
      "epss": "0.00277",
      "percentile": "0.19773"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-80599\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-28T08:16:43.700\",\"lastModified\":\"2026-08-29T07:16:44.890\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbatman-adv: dat: ensure accessible eth_hdr proto field\\n\\nWhen batadv_get_vid() accesses the proto field of the ethernet header, it\\nis not checking if the data itself is accessible. The caller is responsible\\nfor it. But in contrast to other call sites, batadv_dat_get_vid() and its\\ncaller didn\u0027t make sure this is true. This could have caused an\\nout-of-bounds access.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/batman-adv/distributed-arp-table.c\",\"net/batman-adv/main.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"be1db4f6615b5e6156c807ea8985171c215c2d57\",\"lessThan\":\"da3677b5ed362742d30ceab31bfafcdc74dc2642\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"be1db4f6615b5e6156c807ea8985171c215c2d57\",\"lessThan\":\"6d3ea37074bb747f745d28138f87745ba9bd97c5\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"be1db4f6615b5e6156c807ea8985171c215c2d57\",\"lessThan\":\"7913935d41f166c367bbf7cc76a79e50044388e8\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"be1db4f6615b5e6156c807ea8985171c215c2d57\",\"lessThan\":\"3c62694c31f043568c3f4784b8d247cc3bea6b4c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"be1db4f6615b5e6156c807ea8985171c215c2d57\",\"lessThan\":\"5836a050d02e9598fa0f71e88dde28b63dfa35e3\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"be1db4f6615b5e6156c807ea8985171c215c2d57\",\"lessThan\":\"8f76277d02176cd739945bba3379448e2e22e799\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"be1db4f6615b5e6156c807ea8985171c215c2d57\",\"lessThan\":\"4407ff3af469356f9641c4a6e7072309bae86bea\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"be1db4f6615b5e6156c807ea8985171c215c2d57\",\"lessThan\":\"26560c4a03dc4d607331600c187f59ab2df5f341\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/batman-adv/distributed-arp-table.c\",\"net/batman-adv/main.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"3.13\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"3.13\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.261\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.212\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.178\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.145\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.97\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.40\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.5\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H\",\"baseScore\":8.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"ADJACENT_NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.2}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/26560c4a03dc4d607331600c187f59ab2df5f341\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/3c62694c31f043568c3f4784b8d247cc3bea6b4c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/4407ff3af469356f9641c4a6e7072309bae86bea\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/5836a050d02e9598fa0f71e88dde28b63dfa35e3\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/6d3ea37074bb747f745d28138f87745ba9bd97c5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/7913935d41f166c367bbf7cc76a79e50044388e8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/8f76277d02176cd739945bba3379448e2e22e799\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/da3677b5ed362742d30ceab31bfafcdc74dc2642\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-31T08:43:51+00:00",
      "cve": "CVE-2026-80599",
      "id": "CVE-2026-80599",
      "initial_release_date": "2026-08-28T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: batman-adv: dat: ensure accessible eth_hdr proto field",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80599.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.