batman-adv: retrieve ethhdr after potential skb realloc on RX

Summary

In the Linux kernel, the following vulnerability has been resolved: batman-adv: retrieve ethhdr after potential skb realloc on RX pskb_may_pull() in batadv_interface_rx() could reallocate the buffer behind the skb. Variables which were pointing to the old buffer need to be reassigned to avoid an use-after-free. This was done correctly for the VLAN header but missed for the ethernet header which is later used for the TT and AP isolation handling.

Timeline

1. Aug 15, 2026, 5:54 AM UTCCVE published
2. Oct 16, 2026, 6:44 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: no · Technical impact: total

3. Oct 16, 2026, 6:45 PM UTCRecord last updated

Affected versions

• Linux Linux

  From c6c8fea29769d998d94fcec9b9f14d4b52b349d3 · fixed in 6e189f14d1ea28db212b9d70a02131a7ce518012; From c6c8fea29769d998d94fcec9b9f14d4b52b349d3 · fixed in a1820344b180cb55af748f102bc536b5c93164db; From c6c8fea29769d998d94fcec9b9f14d4b52b349d3 · fixed in 6abf73589bed3f27ee240c08108feb72bed0b9c6; From c6c8fea29769d998d94fcec9b9f14d4b52b349d3 · fixed in f19259395b44af67f3c274e34237c295b526b859; From c6c8fea29769d998d94fcec9b9f14d4b52b349d3 · fixed in 2cefa5141cab8ec1e4b24cf585958b13f2e3049d; From c6c8fea29769d998d94fcec9b9f14d4b52b349d3 · fixed in 85a71a81854e0e191ad0e533eabb4eff54866feb; From c6c8fea29769d998d94fcec9b9f14d4b52b349d3 · fixed in b031fc97e1993d29d6c3a0e86a99140528cf31e8; From c6c8fea29769d998d94fcec9b9f14d4b52b349d3 · fixed in 035e1fed892d3d06002a73ff73668f618a514644

• Linux Linux

  2.6.38

• KernelLinux

  From 2.6.38 · fixed in 5.10.261; From 5.11.0 · fixed in 5.15.212; From 5.16.0 · fixed in 6.1.178; From 6.2.0 · fixed in 6.6.145; From 6.7.0 · fixed in 6.12.97; From 6.13.0 · fixed in 6.18.40; From 6.19.0 · fixed in 7.1.5

References 8