CVE-2026-72228

A flaw was found in the batman-adv component of the Linux kernel. This vulnerability occurs during the processing of network packets that have fragmented data. Specifically, if a packet's fragmented data fails a preparation step called linearization, a reference to a network interface (primary_if) is not properly released, leading to a memory leak. This issue could potentially be exploited by a local attacker to cause resource exhaustion, resulting in a Denial of Service (DoS) for the system.

This vulnerability is evaluated as Moderate severity for Red Hat products because triggering the condition requires local privileges and can only result in resource exhaustion rather than arbitrary code execution or data leakage. The flaw exists within the batman-adv kernel subsystem, an optional mesh networking protocol that is not utilized or configured in default Red Hat Enterprise Linux environments. As a result, the blast radius is strictly limited to systems specifically deployed with active B.A.T.M.A.N. mesh interfaces.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.