CVE-2026-72234

A flaw was found in the Linux kernel's batman-adv module. When the pskb_may_pull() function is called by batadv_get_vid(), it can reallocate a buffer. However, a pointer to the old buffer, specifically unicast_packet, was not correctly reassigned, leading to a use-after-free condition. This memory corruption vulnerability could allow a local attacker to cause a denial of service or potentially escalate privileges.

This vulnerability is rated as Moderate severity because it requires local access with unprivileged user permissions to trigger memory corruption, primarily resulting in a denial of service rather than arbitrary code execution. Red Hat Enterprise Linux does not compile or enable the B.A.T.M.A.N. advanced mesh routing subsystem by default, shielding typical enterprise deployments from risk. Consequently, the flaw only poses a practical threat in specialized or customized environments where this networking module is explicitly present and active.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.