CVE-2026-80601: batman-adv: gw: acquire ethernet header only after skb realloc
In the Linux kernel, the following vulnerability has been resolved:
batman-adv: gw: acquire ethernet header only after skb realloc
The pskbmaypull() called by batadvgetvid() could reallocate the buffer behind the skb. Variables which were pointing to the old buffer need to be reassigned to avoid an use-after-free.
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems running the Linux kernel with the batman-adv gateway code are exposed. The issue occurs when batadv_get_vid() calls pskb_may_pull(), which can reallocate the packet buffer while code still holds pointers to the old buffer.
What condition triggers the use-after-free?
Exploitation requires packet-processing conditions that cause pskb_may_pull() to reallocate the skb buffer during batman-adv gateway handling. Stale variables pointing to the pre-reallocation buffer can then be used after that buffer is freed.
What should be done if an affected kernel is in use?
Apply a kernel update containing the upstream stable fixes referenced for this vulnerability. The provided information does not identify a configuration workaround or a method to determine whether the flaw has already been exploited.