EUVD-2026-80551
GHSA-27vc-6rpf-73gh
Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
batman-adv is adjacent-network L2 (AV:A); triggering needs a race against hard-interface teardown (AC:H); no auth to inject mesh frames (PR:N); UAF crashes the kernel (A:H) with no real confidentiality and only marginal integrity impact.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
7DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
batman-adv: fix stale receive device on merged fragments
Fragment reassembly reuses the skb from the highest-numbered buffered fragment as the merged packet. When that fragment was received on a hard interface which is deleted before the chain completes, the merged skb can re-enter the receive path with a stale skb->dev and skb_iif.
batadv_batman_skb_recv() passes such merged packets through the normal receive handlers again. DAT and bridge loop avoidance both derive the ARP header length from skb->dev, so they can dereference the freed net_device before the packet reaches the local mesh interface.
Refresh the receive device metadata from the current receive device before running the packet handlers. This keeps internally reinjected merged fragments consistent with the normal receive path after hard interface teardown.
AnalysisAI
A use-after-free in the Linux kernel's batman-adv (B.A.T.M.A.N. advanced) mesh networking module lets an attacker on the adjacent mesh trigger a kernel crash by exploiting stale receive-device metadata on reassembled fragments. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires the batman-adv (B.A.T.M.A.N. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a use-after-free (CWE-416) in the Linux kernel batman-adv mesh networking module. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: update to Linux 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.110, 6.18.51, 7.2.5 or 7.3-rc1, or pull the corresponding stable commits listed in the references (for example https://git.kernel.org/stable/c/f4b4ae763b5d59319fad62a00c76676758e7dafa and https://git.kernel.org/stable/c/63d86250fa7cbe22451369bd1c0881dfc8190958); distributions should be tracked through their own kernel advisories, since the fix is delivered as a backport. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all systems running the Linux kernel with the batman-adv module enabled and verify exposure; apply the vendor-released patch as soon as possible, prioritizing internet-facing or critical mesh nodes. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today