CRITICAL Introduced in 5.1
batman-adv DatSnoop UAF
CVE-2026-80600
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
KernelScan AI8.7HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: batman-adv: dat: acquire ARP hw source only after skb realloc The pskb_may_pull() called by batadv_get_vid() could reallocate the buffer behind the skb. Variables which were pointing to the old buffer need to be reassigned to avoid an use-after-free.
02KernelScan AI Analysis
Risk summary
A use-after-free in the batman-adv distributed ARP table DHCPACK snooping path can be triggered by a crafted packet on a mesh network. An attacker on the same mesh segment could potentially exploit this for code execution or denial of service.
Vulnerability analysis
When batman-adv processes an incoming DHCPACK packet, it extracts a pointer to the Ethernet header before calling a function that may reallocate the socket buffer. If reallocation occurs, the previously cached pointer becomes stale, leading to a use-after-free when the old header data is subsequently read. The fix reorders the code to re-fetch the Ethernet header pointer after the potential reallocation completes. This vulnerability is reachable from the mesh network by any participant that can send a crafted DHCPACK frame to a node running batman-adv with the distributed ARP table feature enabled.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 5.10 | 5.1 | 5.10.261 | a82fc217cb7a |
| 6.1 | 5.1 | 6.1.178 | d755cd001fa2 |
| 6.12 | 5.1 | 6.12.97 | 01678c53a771 |
| 7.1 | 5.1 | 7.1.5 | 059a70e1d12d |
| mainline | 5.1 | 7.2 | 48067b2ae450 |
| 6.6 | 5.1 | 6.6.145 | 3404be97b940 |
| 6.18 | 5.1 | 6.18.40 | 3b4c70c40f2e |
| 5.15 | 5.1 | 5.15.212 | 86aa79b43e5b |
| cip/5.10 | 5.1 | 5.10.263-cip76 | a82fc217cb7a |
| cip/5.10-rt | 5.1 | 5.10.268-cip77-rt34 | a82fc217cb7a |
| cip/6.1 | 5.1 | 6.1.182-cip59 | d755cd001fa2 |
| cip/6.1-rt | 5.1 | 6.1.182-cip59-rt31 | d755cd001fa2 |
| cip/6.12 | 5.1 | 6.12.101-cip29 | 01678c53a771 |