What is the CVSS score of CVE-2026-72226?

CVE-2026-72226 has a contested CVSS base score of 9.8 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Which versions of Linux Kernel are affected by CVE-2026-72226?

A critical integer-overflow vulnerability in the Linux kernel's batman-adv mesh networking module (CVE-2026-72226) enables nodes on the same mesh network to corrupt translation-table processing and…. A patch is available.

How to fix or mitigate CVE-2026-72226?

Within 24 hours, identify and catalog all systems running batman-adv mesh networking by querying kernel module inventories and network topology documentation. Within 7 days, obtain the vendor-released patch from your Linux distribution's security advisory, test in a staging environment, and establish a patching timeline coordinated with network infrastructure teams. Within 30 days, deploy the kernel patch across all affected batman-adv systems using your standard maintenance windows, validate mesh network functionality post-deployment, and confirm patch installation via kernel version audits.

Linux Kernel CVE-2026-72226

EUVD-2026-59125 CRITICAL

2026-08-15 416baaa9-dc9f-4396-8d5f-8c081fb06d67

GHSA-5r79-5r2g-4hhm

Buffer Overflow Linux Red Hat Suse

Critical

Disputed · 9.8 Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Severity by source

Sources disagree (Medium–Critical)

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

batman-adv parses L2 mesh frames so AV:A not AV:N; no auth or interaction (PR:N/UI:N); OOB access yields near-certain DoS (A:H) and plausible kernel memory disclosure (C:H), with memory write unconfirmed (I:N).

3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Red Hat

5.5 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 17, 2026 - 07:47 vuln.today

CVSS changed

Aug 17, 2026 - 06:22 NVD

9.8 (CRITICAL)

Patch available

Aug 15, 2026 - 07:20 EUVD

CVE Published

Aug 15, 2026 - 06:21 cve.org

CRITICAL 9.8

CVE Published

Aug 15, 2026 - 06:21 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

batman-adv: tt: prevent TVLV OOB check overflow

A TT unicast TVLV contains the number of VLANs stored in it. This number is an u16 and gets multiplied by the size of the struct batadv_tvlv_tt_vlan_data (8 bytes). The size can therefore overflow the u16 used to store the tt_vlan_len. All additional safety checks to prevent out-of-bounds access of the TVLV buffer are invalid due to this overflow.

Using size_t prevents this overflow and ensures that the safety checks compare against the actual buffer requirements.

AnalysisAI

Integer-overflow-driven out-of-bounds access in the Linux kernel's batman-adv (B.A.T.M.A.N. advanced) mesh networking module allows a node on the same mesh to corrupt translation-table processing via a crafted TT unicast TVLV. The VLAN count (u16) multiplied by the 8-byte batadv_tvlv_tt_vlan_data size overflows the u16 length variable, defeating every downstream bounds check that guards the TVLV buffer. This is a fixed, patched kernel bug with a low EPSS (0.22%, 13th percentile) and no public exploit identified at time of analysis; it is not listed in CISA KEV.

Technical ContextAI

batman-adv is an in-kernel Layer 2 mesh routing protocol (net/batman-adv) used to build ad-hoc/community mesh networks where every participating node exchanges routing metadata over raw Ethernet frames. Translation-table (TT) synchronization is carried in TVLV (Type-Version-Length-Value) containers; a TT unicast TVLV declares how many VLANs it describes. The root cause is a classic integer/multiplication overflow (CWE-190) leading to out-of-bounds access (CWE-125/CWE-787 class): num_vlans (u16) * sizeof(struct batadv_tvlv_tt_vlan_data) (8) is computed and stored back into a u16 tt_vlan_len, so any count above 8191 wraps around. Because the wrapped length is smaller than the real data footprint, the subsequent 'is the buffer big enough' safety checks pass incorrectly, and the parser reads/walks past the allocated TVLV buffer. The upstream fix widens the arithmetic to size_t so the length reflects the true requirement and the existing checks become valid again. CWE is reported as N/A in the feed but the behavior maps to integer overflow to OOB memory access.

RemediationAI

Vendor-released patch: update to a fixed stable kernel - 6.18.40, 6.12.97, 6.6.145, 6.1.178, 5.15.212, 5.10.261, 7.1.5, or 7.2-rc3 (or later) as matches your branch - using the git.kernel.org stable commits (e.g. 3256c05d5a9db34346eaf20f52dddde984852d77 and the sibling backports). If you cannot immediately reboot into a patched kernel, the highest-leverage compensating control is to unload/blacklist the module where mesh functionality is not required (rmmod batman_adv and blacklist batman-adv in modprobe.d), which fully removes the attack surface at the cost of disabling mesh routing on that host. Where the mesh is needed, restrict which interfaces are enrolled in batman-adv and enforce L2 segmentation/authentication (e.g. WPA3-SAE or MACsec on the mesh transport) so only trusted nodes can inject TVLV frames - this reduces exposure but does not fix the parsing bug. Track the advisory at https://nvd.nist.gov/vuln/detail/CVE-2026-72226.

Same technique Buffer Overflow

View all

CVE-2017-7269 CRITICAL POC

9.8

CVE-2015-5119 CRITICAL POC

9.8

CVE-2015-3113 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2020-0796 CRITICAL POC

10.0

CVE-2019-11043 CRITICAL POC

9.8

CVE-2009-0927 HIGH POC

8.8

CVE-2012-1889 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 16.0	Affected

CVE-2026-72226 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-72226

Severity by source

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Same technique Buffer Overflow

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code