Skip to main content

Linux Kernel EUVDEUVD-2026-59130

| CVE-2026-72231 HIGH
2026-08-15 416baaa9-dc9f-4396-8d5f-8c081fb06d67 GHSA-r9hr-vqwf-9q7r
Information Disclosure Linux Red Hat Suse
7.5
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.3 MEDIUM

batman-adv is Layer 2 adjacent-only (AV:A); reliable triggering requires induced memory pressure making AC:H appropriate; no confidentiality or integrity impact.

3.1 AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:A/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
4.3 MEDIUM
AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Red Hat
5.5 MEDIUM
qualitative

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 17, 2026 - 07:48 vuln.today
CVSS changed
Aug 17, 2026 - 06:22 NVD
7.5 (HIGH)
Patch available
Aug 15, 2026 - 07:20 EUVD
CVE Published
Aug 15, 2026 - 06:21 cve.org
HIGH 7.5
CVE Published
Aug 15, 2026 - 06:21 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

batman-adv: tt: avoid request storms during pending request

batadv_send_tt_request() allocates a tt_req_node when none exists for the destination originator node. This should prevent that a multiple TT requests are send at the same time to an originator.

But if allocation of the send buffer failed, this request must be cleaned up again. But indicator for such a failure is "ret false". But the actual implementation is checking for "ret true".

The check must be inverted to not loose the information about the TT request directly after it was attempted to be sent out. This should avoid potential request storms.

AnalysisAI

Request storm vulnerability in the Linux kernel's batman-adv mesh networking subsystem (B.A.T.M.A.N. Advanced) exposes nodes to availability degradation through an inverted boolean condition in batadv_send_tt_request(). When a send buffer allocation fails, an incorrect check (ret true instead of ret false) causes the tt_req_node tracking structure to be retained rather than cleaned up, breaking the de-duplication mechanism that prevents simultaneous TT requests to the same originator. The result is that repeated, redundant translation table requests can flood a mesh peer - a request storm - degrading availability of nodes on the batman-adv overlay. No public exploit code exists and EPSS exploitation probability is very low (0.22%, 13th percentile); no active exploitation is confirmed.

Technical ContextAI

B.A.T.M.A.N. Advanced (batman-adv) is a Linux kernel mesh networking module implementing a Layer 2 routing protocol for wireless ad-hoc networks. The translation table (TT) subsystem maintains a distributed mapping of client MAC addresses to gateway nodes. batadv_send_tt_request() is responsible for issuing unicast TT lookup requests and allocates a tt_req_node entry per destination originator to ensure only one request is in-flight at a time. CWE is not assigned, but the root cause is a logic inversion (inverted boolean return check) - a variant of CWE-670 (Always-Incorrect Control Flow Implementation). When kmalloc or skb_alloc fails for the send buffer, the function returns false, but the code checks 'ret == true' to decide whether to free the node, meaning the node is freed on success and leaked on failure. This leaves a stale pending-request record that prevents future cleanup and allows unconstrained re-queuing of TT requests. The vulnerability exists from kernel commit 335fbe0f5d25 (introduction of the TT subsystem) through to multiple stable branches.

RemediationAI

Upgrade to a patched stable kernel release: 5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, or 7.1.5 (or mainline 7.2-rc3+). The upstream fixes are available as individual commits at https://git.kernel.org/stable/c/067e413eec2e63c2996909ef55214b3a0eda0be7 and seven related stable-backport commits. If immediate kernel upgrade is not feasible, a workaround is to unload or blacklist the batman-adv kernel module ('modprobe -r batman-adv' and adding 'blacklist batman-adv' to /etc/modprobe.d/), which eliminates the attack surface entirely at the cost of disabling all batman-adv mesh functionality. Restricting batman-adv mesh participation to trusted Layer 2 segments (via VLAN isolation or physical access control) reduces the exploitable adjacency domain but does not eliminate the bug. No vendor advisory URL beyond the kernel.org git references and https://nvd.nist.gov/vuln/detail/CVE-2026-72231 is available at time of analysis.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

EUVD-2026-59130 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy