Linux Kernel EUVD-2026-59131

The batman-adv (Better Approach To Mobile Adhoc Networking Advanced) driver is a mesh networking protocol implementation merged into the Linux kernel mainline since version 2.6.38. The vulnerable function, batadv_interface_tx(), serves as the TX path entry point for batadv interfaces and previously assumed that incoming sk_buff packets already satisfied the ETH_HLEN (14-byte Ethernet header) minimum, delegating that guarantee to the network stack's min_header_len mechanism. However, as established by the analogous bridge driver fix in commit 8bd67ebb50c0, eBPF TC (Traffic Control) hook programs operating in the kernel's ingress/egress path are capable of truncating sk_buff data to fewer than ETH_HLEN bytes before redirecting the packet to a batadv interface, bypassing the expected length guarantee entirely. The result is that batadv_interface_tx() reads beyond the allocated sk_buff data region. Although no CWE is formally assigned in the NVD entry, the root cause class is out-of-bounds read (CWE-125), with associated risks of kernel heap content disclosure or, under favorable memory layout conditions, heap corruption leading to privilege escalation.