CVE-2026-72230

A flaw was found in the batman-adv (Better Approach To Mobile Ad-hoc Networking - Advanced) fragmentation module of the Linux kernel. The batadv_frag_send_packet() function, responsible for sending fragmented packets, does not properly free allocated memory when a packet is deemed unfragmentable due to an empty payload or zero fragment size. This oversight can lead to a memory leak, potentially affecting system stability and performance.

A memory leak flaw was found in the Linux kernel's batman-adv (Better Approach To Mobile Ad-hoc Networking - Advanced) packet fragmentation code. When batadv_frag_send_packet() rejected a packet as unfragmentable because of an empty payload or a zero fragment size, it returned an error without freeing the associated socket buffer (skb), even though callers of the function assume the skb is always consumed. Repeatedly triggering this error path leaks kernel memory, which can degrade system stability and performance and ultimately lead to a denial of service through memory exhaustion. Red Hat rated this flaw Moderate (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), affecting only availability, because exploiting it requires the ability to locally originate the malformed batman-adv traffic that reaches the flawed error path. The vulnerable code is not present in the Red Hat Enterprise Linux kernels (including kernel-rt) or in the Red Hat In-Vehicle OS kernels (kernel and kernel-ivos-qualcomm) covered by this flaw, so all Red Hat products tracked for this issue are marked not affected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.