Linux Kernel CVE-2026-72233

batman-adv (B.A.T.M.A.N. Advanced) is a Layer 2 mesh networking protocol implemented as a Linux kernel module, used primarily in community wireless mesh networks. Its Bridge Loop Avoidance (BLA) feature coordinates multiple backbone gateways to prevent Ethernet bridging loops. The vulnerable function batadv_bla_is_backbone_gw() calls pskb_may_pull() to linearize non-contiguous socket buffer data - a standard kernel pattern. However, pskb_may_pull() may trigger a kmalloc reallocation of skb->head, invalidating any raw pointer into the old data area computed before the call. The gateway address variable derived from the pre-realloc buffer is then used post-realloc, constituting a classic use-after-free (CWE-416 pattern, though NVD lists CWE as N/A for this entry). The bug was introduced with commit 9e794b6bf4a2c65d698d7433ddfabc54a5d53a88 and exists across all Linux stable branches until the respective backported fixes. The fix pattern - reassigning the pointer after pskb_may_pull() returns - is standard kernel practice for this class of bug.