CVE-2026-80599: batman-adv: dat: ensure accessible eth_hdr proto field
In the Linux kernel, the following vulnerability has been resolved:
batman-adv: dat: ensure accessible ethhdr proto field
When batadvgetvid() accesses the proto field of the ethernet header, it is not checking if the data itself is accessible. The caller is responsible for it. But in contrast to other call sites, batadvdatgetvid() and its caller didn't make sure this is true. This could have caused an out-of-bounds access.
Affected Software
Event History
Frequently Asked Questions
What condition is required to trigger the out-of-bounds access?
The vulnerable path is reached when batadv_dat_get_vid() calls batadv_get_vid() without ensuring that the Ethernet header's protocol field is accessible. A packet or buffer with insufficient accessible data at that point could cause the out-of-bounds access.
Which systems are exposed?
The issue affects Linux kernel installations using the batman-adv DAT code path. The provided information does not identify affected kernel versions or state whether the configuration is enabled by default.
How can I determine whether a fix is available for my kernel?
Check whether your kernel source or vendor kernel includes one of the referenced stable commits: da3677b5ed362742d30ceab31bfafcdc74dc2642, 6d3ea37074bb747f745d28138f87745ba9bd97c5, or 7913935d41f166c367bbf7cc76a79e50044388e8.