CVE-2026-72227

A flaw was found in the Linux kernel's batman-adv component. An out-of-bounds read vulnerability exists in the mcast module due to an incorrect size check when accessing the num_dests header. This flaw could allow an attacker to read sensitive information from memory or cause a denial of service.

This vulnerability is rated as Moderate severity for Red Hat because triggering the flaw requires an active B.A.T.M.A.N. advanced mesh network setup and primarily results in a kernel crash leading to a denial of service rather than arbitrary code execution. In typical enterprise environments, mesh routing protocols are rarely utilized and remain unconfigured by default. Furthermore, supported Red Hat Enterprise Linux kernels do not ship the vulnerable multicast tracking implementation, leaving standard installations unaffected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.