What is the CVSS score of CVE-2026-72234?

CVE-2026-72234 has a contested CVSS base score of 9.8 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Which versions of Linux Kernel are affected by CVE-2026-72234?

A use-after-free vulnerability in the Linux kernel's batman-adv mesh networking module (CVE-2026-72234) creates a critical memory safety defect affecting organizations operating B.A.T.M.A.N.. A patch is available.

How to fix or mitigate CVE-2026-72234?

Within 24 hours, identify all systems running batman-adv mesh networking by checking kernel module status and network configurations, then obtain the vendor-released patch from your Linux distribution provider. Within 7 days, apply the patch to non-production batman-adv systems in a staged deployment, testing stability in staging environments before production rollout. Within 30 days, complete patch deployment across all production batman-adv mesh infrastructure, verifying all nodes are running patched kernel versions.

Linux Kernel CVE-2026-72234

EUVD-2026-59133 CRITICAL

2026-08-15 416baaa9-dc9f-4396-8d5f-8c081fb06d67

GHSA-mcgw-cw9v-8cmp

Information Disclosure Linux Red Hat Suse

Critical

Disputed · 9.8 Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Severity by source

Sources disagree (Medium–Critical)

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

5.9 MEDIUM

batman-adv processes L2 mesh frames so AV:A; a reallocation race gives AC:H; no auth to send frames means PR:N; impact is chiefly crash (A:H) with possible memory leak (C:L).

3.1 AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H

4.0 AV:A/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Red Hat

5.5 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 17, 2026 - 07:50 vuln.today

CVSS changed

Aug 17, 2026 - 06:22 NVD

9.8 (CRITICAL)

Patch available

Aug 15, 2026 - 07:20 EUVD

CVE Published

Aug 15, 2026 - 06:21 cve.org

CRITICAL 9.8

CVE Published

Aug 15, 2026 - 06:21 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

batman-adv: access unicast_ttvn skb->data only after skb realloc

The pskb_may_pull() called by batadv_get_vid() could reallocate the buffer behind the skb. Variables which were pointing to the old buffer need to be reassigned to avoid an use-after-free.

This was done correctly for the ethernet header but missed for the unicast_packet pointer.

AnalysisAI

Use-after-free in the Linux kernel's batman-adv mesh networking module (net/batman-adv unicast path) occurs because the unicast_packet pointer is not reassigned after pskb_may_pull() inside batadv_get_vid() may reallocate the socket buffer, leaving a stale pointer into freed memory. Systems running batman-adv B.A.T.M.A.N. advanced mesh routing are affected across a wide range of stable kernel series. No public exploit identified at time of analysis, and EPSS exploitation probability is low (0.22%, 13th percentile).

Technical ContextAI

batman-adv (B.A.T.M.A.N. Advanced) is an in-kernel Layer 2 mesh routing protocol that forwards Ethernet-like frames between mesh nodes. When processing an incoming unicast packet, the code calls batadv_get_vid() to read the VLAN identifier, which internally invokes pskb_may_pull(); this helper may linearize or grow the skb, causing the underlying data buffer (skb->data) to be reallocated at a new address. The fix correctly re-derived the Ethernet header pointer after this call but failed to also refresh the unicast_packet pointer, so subsequent dereferences read from the old, now-freed buffer. This is a classic CWE-416 (Use After Free)/stale-pointer-after-reallocation bug; the input lists CWE as N/A, so the root-cause class is inferred from the description rather than an assigned CWE.

RemediationAI

Vendor-released patch: update to a fixed stable kernel - 5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, 7.1.5, or 7.2-rc2 (or later within your series), applying the fix commit for your branch as listed at https://git.kernel.org/stable/c/7141990add3f75436f2933cb310654cad3b1e3e9 and the other referenced commits. Where immediate kernel updates are not feasible, the most effective compensating control is to unload/blacklist the batman-adv module on hosts that do not require mesh routing (add it to modprobe blacklist), which fully removes exposure but disables B.A.T.M.A.N. mesh functionality; for hosts that must run the mesh, restrict which nodes can join the mesh (authenticated/segmented L2 mesh, trusted RF/link membership) to limit who can inject the crafted unicast frames, accepting that this narrows but does not eliminate risk. Confirm the exact fix commit for your kernel branch before deploying.

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 16.0	Affected

CVE-2026-72234 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-72234

Severity by source

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code