What is the CVSS score of CVE-2026-72227?

CVE-2026-72227 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel are affected by CVE-2026-72227?

Organizations running Linux 6.12 (pre-6.12.97), 6.18 (pre-6.18.40), or 7.1 (pre-7.1.5) kernels face a kernel memory exposure and denial-of-service risk via CVE-2026-72227.. A patch is available.

How to fix or mitigate CVE-2026-72227?

Within 24 hours, identify all systems running Linux kernel versions prior to 6.12.97, 6.18.40, 7.1.5, or 7.2-rc3. Within 7 days, deploy vendor-provided kernel patches to staging environments and begin production rollout based on change windows. Within 30 days, complete patching across all affected systems and validate kernel version compliance through infrastructure scanning.

Linux Kernel CVE-2026-72227

EUVD-2026-59126 HIGH

2026-08-15 416baaa9-dc9f-4396-8d5f-8c081fb06d67

GHSA-h862-94w3-mqrr

Information Disclosure Linux Red Hat Suse

8.1

CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY

8.1 HIGH

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

vuln.today AI

8.1 HIGH

Adjacent vector confirmed by batman-adv layer-2 mesh protocol scope; PR:N because no credentials are needed on the adjacent network; OOB read yields memory disclosure and crash risk but no write primitive, so I:N.

3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

4.3 MEDIUM

AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Red Hat

5.5 MEDIUM

qualitative

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 17, 2026 - 07:47 vuln.today

CVSS changed

Aug 17, 2026 - 06:22 NVD

8.1 (HIGH)

Patch available

Aug 15, 2026 - 07:20 EUVD

CVE Published

Aug 15, 2026 - 06:21 cve.org

HIGH 8.1

CVE Published

Aug 15, 2026 - 06:21 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

batman-adv: mcast: avoid OOB read of num_dests header

Before the access to struct batadv_tvlv_mcast_tracker's num_dests, it is attempted to check whether enough space is actually in the network header. But instead of using offsetofend() to check for the whole size (2) which must be accessible, offsetof() of is called. The latter is always returning

The comparison with the network header length will always return that

enough data is available - even when only 1 or 0 bytes are accessible.

Instead of using offsetofend(), use the more common check for the whole header.

AnalysisAI

Out-of-bounds read in the Linux kernel's batman-adv multicast tracker exposes adjacent-network unauthenticated attackers to kernel memory disclosure or denial-of-service via a crafted TVLV mcast tracker packet. The root cause is a C macro misuse - offsetof() on the first struct member always evaluates to 0, making the bounds check a no-op that permits access to num_dests even when only 0 or 1 byte is in the received packet instead of the required 2. EPSS is 0.21% (11th percentile), no CISA KEV entry exists, and no public exploit is identified; vendor-released patches are available in Linux 6.12.97, 6.18.40, 7.1.5, and 7.2-rc3.

Technical ContextAI

batman-adv (Better Approach To Mobile Adhoc Networking Advanced) is a Linux kernel module implementing a layer-2 mesh routing protocol. It encodes metadata in TVLV (Type-Version-Length-Value) extension records; the mcast tracker TVLV carries struct batadv_tvlv_mcast_tracker whose first member is a uint16_t num_dests. The bug is a classic C macro confusion: offsetof(struct, first_member) always evaluates to 0, so the guard 'if (tvlv_length < offsetof(..., num_dests))' reduces to 'if (tvlv_length < 0)', which is never true. This means the kernel proceeds to read 2 bytes from num_dests regardless of actual available payload length. The correct fix uses offsetofend() or a sizeof() check to verify at least 2 bytes are present. The vulnerability was introduced at commit 07afe1ba288c and was corrected across four stable branches published at kernel.org.

RemediationAI

Vendor-released patches are available: upgrade to Linux kernel 6.12.97, 6.18.40, 7.1.5, or 7.2-rc3 or later, selecting the appropriate stable series for your deployment; patch commits are published at kernel.org stable (see affected products section for direct links). For systems that do not require batman-adv mesh networking, unload the module immediately with 'rmmod batman-adv' and blacklist it by adding 'blacklist batman-adv' to /etc/modprobe.d/batman-adv-blacklist.conf - this eliminates the attack surface with no trade-off on non-mesh systems. For systems where batman-adv is operationally required and an immediate kernel upgrade is not feasible, restrict layer-2 access to the mesh interface at the physical or VLAN boundary so that only trusted peer nodes can send TVLV frames; note this reduces but does not eliminate risk, as compromise of any trusted adjacent node would restore the attack surface.

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0	Not-Affected

CVE-2026-72227 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-72227

Severity by source

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code