Vulnerability-Lookup

GHSA-R9HR-VQWF-9Q7R

Vulnerability from github – Published: 2026-08-15 06:32 – Updated: 2026-08-17 06:33

Details

In the Linux kernel, the following vulnerability has been resolved:

batman-adv: tt: avoid request storms during pending request

batadv_send_tt_request() allocates a tt_req_node when none exists for the destination originator node. This should prevent that a multiple TT requests are send at the same time to an originator.

But if allocation of the send buffer failed, this request must be cleaned up again. But indicator for such a failure is "ret == false". But the actual implementation is checking for "ret == true".

The check must be inverted to not loose the information about the TT request directly after it was attempted to be sent out. This should avoid potential request storms.

Severity

7.5 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-72231"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-15T06:21:50Z",
    "severity": "HIGH"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nbatman-adv: tt: avoid request storms during pending request\n\nbatadv_send_tt_request() allocates a tt_req_node when none exists for the\ndestination originator node. This should prevent that a multiple TT\nrequests are send at the same time to an originator.\n\nBut if allocation of the send buffer failed, this request must be cleaned\nup again. But indicator for such a failure is \"ret == false\". But the\nactual implementation is checking for \"ret == true\".\n\nThe check must be inverted to not loose the information about the TT\nrequest directly after it was attempted to be sent out. This should avoid\npotential request storms.",
  "id": "GHSA-r9hr-vqwf-9q7r",
  "modified": "2026-08-17T06:33:18Z",
  "published": "2026-08-15T06:32:16Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-72231"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/067e413eec2e63c2996909ef55214b3a0eda0be7"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/21c44a6895f41df811d1c91d10eea194dda2b345"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/27c7d40008231ae4140d35501b60087a9de2d2c3"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/5e46c76d9a5062212c4c5f642a5549fd9c057f8a"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/6055695ea40c64a47e00742c12c99b1a33b4daed"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/6a65ac8a81e903bb4b555c1d13532f5cb0167a4a"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/716f434eb35869e130424331584a91fbb729b9bd"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/aba1cf21954e64c36afb966b754adad2b0b8aa48"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

CVE-2026-72231 (GCVE-0-2026-72231)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:54 – Updated: 2026-08-17 05:41

Title

batman-adv: tt: avoid request storms during pending request

Summary

In the Linux kernel, the following vulnerability has been resolved: batman-adv: tt: avoid request storms during pending request batadv_send_tt_request() allocates a tt_req_node when none exists for the destination originator node. This should prevent that a multiple TT requests are send at the same time to an originator. But if allocation of the send buffer failed, this request must be cleaned up again. But indicator for such a failure is "ret == false". But the actual implementation is checking for "ret == true". The check must be inverted to not loose the information about the TT request directly after it was attempted to be sent out. This should avoid potential request storms.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Assigner

Linux mitre root

References

8 references

URL	Tags
https://git.kernel.org/stable/c/6055695ea40c64a47…
https://git.kernel.org/stable/c/21c44a6895f41df81…
https://git.kernel.org/stable/c/5e46c76d9a5062212…
https://git.kernel.org/stable/c/067e413eec2e63c29…
https://git.kernel.org/stable/c/716f434eb35869e13…
https://git.kernel.org/stable/c/6a65ac8a81e903bb4…
https://git.kernel.org/stable/c/aba1cf21954e64c36…
https://git.kernel.org/stable/c/27c7d40008231ae41…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 335fbe0f5d2501b7dd815806aef6fd9bad784eb1 , < 6055695ea40c64a47e00742c12c99b1a33b4daed (git) Affected: 335fbe0f5d2501b7dd815806aef6fd9bad784eb1 , < 21c44a6895f41df811d1c91d10eea194dda2b345 (git) Affected: 335fbe0f5d2501b7dd815806aef6fd9bad784eb1 , < 5e46c76d9a5062212c4c5f642a5549fd9c057f8a (git) Affected: 335fbe0f5d2501b7dd815806aef6fd9bad784eb1 , < 067e413eec2e63c2996909ef55214b3a0eda0be7 (git) Affected: 335fbe0f5d2501b7dd815806aef6fd9bad784eb1 , < 716f434eb35869e130424331584a91fbb729b9bd (git) Affected: 335fbe0f5d2501b7dd815806aef6fd9bad784eb1 , < 6a65ac8a81e903bb4b555c1d13532f5cb0167a4a (git) Affected: 335fbe0f5d2501b7dd815806aef6fd9bad784eb1 , < aba1cf21954e64c36afb966b754adad2b0b8aa48 (git) Affected: 335fbe0f5d2501b7dd815806aef6fd9bad784eb1 , < 27c7d40008231ae4140d35501b60087a9de2d2c3 (git)
Linux	Linux	Affected: 3.13 Unaffected: 0 , < 3.13 (semver) Unaffected: 5.10.261 , ≤ 5.10.* (semver) Unaffected: 5.15.212 , ≤ 5.15.* (semver) Unaffected: 6.1.178 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.97 , ≤ 6.12.* (semver) Unaffected: 6.18.40 , ≤ 6.18.* (semver) Unaffected: 7.1.5 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/batman-adv/translation-table.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6055695ea40c64a47e00742c12c99b1a33b4daed",
              "status": "affected",
              "version": "335fbe0f5d2501b7dd815806aef6fd9bad784eb1",
              "versionType": "git"
            },
            {
              "lessThan": "21c44a6895f41df811d1c91d10eea194dda2b345",
              "status": "affected",
              "version": "335fbe0f5d2501b7dd815806aef6fd9bad784eb1",
              "versionType": "git"
            },
            {
              "lessThan": "5e46c76d9a5062212c4c5f642a5549fd9c057f8a",
              "status": "affected",
              "version": "335fbe0f5d2501b7dd815806aef6fd9bad784eb1",
              "versionType": "git"
            },
            {
              "lessThan": "067e413eec2e63c2996909ef55214b3a0eda0be7",
              "status": "affected",
              "version": "335fbe0f5d2501b7dd815806aef6fd9bad784eb1",
              "versionType": "git"
            },
            {
              "lessThan": "716f434eb35869e130424331584a91fbb729b9bd",
              "status": "affected",
              "version": "335fbe0f5d2501b7dd815806aef6fd9bad784eb1",
              "versionType": "git"
            },
            {
              "lessThan": "6a65ac8a81e903bb4b555c1d13532f5cb0167a4a",
              "status": "affected",
              "version": "335fbe0f5d2501b7dd815806aef6fd9bad784eb1",
              "versionType": "git"
            },
            {
              "lessThan": "aba1cf21954e64c36afb966b754adad2b0b8aa48",
              "status": "affected",
              "version": "335fbe0f5d2501b7dd815806aef6fd9bad784eb1",
              "versionType": "git"
            },
            {
              "lessThan": "27c7d40008231ae4140d35501b60087a9de2d2c3",
              "status": "affected",
              "version": "335fbe0f5d2501b7dd815806aef6fd9bad784eb1",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/batman-adv/translation-table.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.13"
            },
            {
              "lessThan": "3.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.261",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbatman-adv: tt: avoid request storms during pending request\n\nbatadv_send_tt_request() allocates a tt_req_node when none exists for the\ndestination originator node. This should prevent that a multiple TT\nrequests are send at the same time to an originator.\n\nBut if allocation of the send buffer failed, this request must be cleaned\nup again. But indicator for such a failure is \"ret == false\". But the\nactual implementation is checking for \"ret == true\".\n\nThe check must be inverted to not loose the information about the TT\nrequest directly after it was attempted to be sent out. This should avoid\npotential request storms."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The bug is reached when remote batman-adv OGM/TVLV packets are received on an active mesh hardif via batadv_batman_skb_recv() \u2192 batadv_iv_ogm_recv() \u2192 batadv_tvlv_ogm_receive() \u2192 batadv_tt_update_orig() \u2192 batadv_send_tt_request(), with no local syscall required on the victim.\nAC:L - A mesh attacker can deterministically craft OGMs with mismatched TTVN/CRC to force the request_table path on every received OGM; the inverted ret check removes the pending tt_req_node after each successful send, eliminating deduplication so storms are repeatable without races.\nPR:N - batman-adv OGM/TVLV processing performs no authentication or capability check on senders; any mesh peer that can inject ETH_P_BATMAN frames onto the victim\u0027s active hardif triggers the vulnerable path without Linux credentials on the victim host.\nUI:N - No victim user action is required once batman-adv is active; the kernel automatically processes incoming OGMs and issues TT_REQUEST unicasts in response to detected translation-table inconsistency, entirely driven by attacker-supplied mesh traffic.\nS:U - Impact is confined to excessive batman-adv translation-table control traffic and resource exhaustion on the victim mesh node within the kernel networking stack; it does not cross VM, container, IOMMU, or other security authority boundaries.\nC:N - The inverted conditional is a pure logic error in tt_req_node list housekeeping; it causes neither out-of-bounds access, use-after-free, nor uninitialized data transmission, so no information-disclosure or memory-read primitive exists.\nI:N - No attacker-controlled kernel memory writes or data corruption occur; the bug only suppresses pending-request tracking so duplicate TT_REQUEST packets are emitted, flooding mesh bandwidth without modifying stored translation-table contents.\nA:H - Removing the tt_req_node immediately after each successful TT_REQUEST disables the one-request-per-originator guard, letting a remote attacker drive unbounded GFP_ATOMIC allocations and mesh-wide TT_REQUEST storms that can exhaust CPU, memory, and link capacity on community mesh nodes."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:41:48.586Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/6055695ea40c64a47e00742c12c99b1a33b4daed"
        },
        {
          "url": "https://git.kernel.org/stable/c/21c44a6895f41df811d1c91d10eea194dda2b345"
        },
        {
          "url": "https://git.kernel.org/stable/c/5e46c76d9a5062212c4c5f642a5549fd9c057f8a"
        },
        {
          "url": "https://git.kernel.org/stable/c/067e413eec2e63c2996909ef55214b3a0eda0be7"
        },
        {
          "url": "https://git.kernel.org/stable/c/716f434eb35869e130424331584a91fbb729b9bd"
        },
        {
          "url": "https://git.kernel.org/stable/c/6a65ac8a81e903bb4b555c1d13532f5cb0167a4a"
        },
        {
          "url": "https://git.kernel.org/stable/c/aba1cf21954e64c36afb966b754adad2b0b8aa48"
        },
        {
          "url": "https://git.kernel.org/stable/c/27c7d40008231ae4140d35501b60087a9de2d2c3"
        }
      ],
      "title": "batman-adv: tt: avoid request storms during pending request",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-72231",
    "datePublished": "2026-08-15T05:54:22.076Z",
    "dateReserved": "2026-08-09T03:40:39.913Z",
    "dateUpdated": "2026-08-17T05:41:48.586Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

GHSA-R9HR-VQWF-9Q7R

CVE-2026-72231 (GCVE-0-2026-72231)

Tags

Sightings

Nomenclature