CVE-2026-80600

A flaw was found in the batman-adv module of the Linux kernel. This vulnerability occurs because the pskb_may_pull() function, when called by batadv_get_vid(), can reallocate a buffer. This causes variables to point to the previously freed memory, leading to a use-after-free condition. A local attacker could potentially exploit this to cause a denial of service or execute arbitrary code.

A moderate-severity use-after-free vulnerability was found in the batman-adv (Batman Advanced) mesh networking module of the Linux kernel. While processing ARP traffic for the Distributed ARP Table (DAT), the pskb_may_pull() call performed by batadv_get_vid() can reallocate the socket buffer (skb) backing data area; pointers into the old buffer, such as the one used to read the ARP hardware source address, are then left dangling, and dereferencing them results in a use-after-free. An attacker able to trigger this condition could cause a kernel crash (denial of service) or potentially execute arbitrary code. Red Hat rates this flaw as Moderate impact with a CVSS 3.1 base score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H); this differs significantly from the upstream CVE record's Critical score of 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), because Red Hat's assessment reflects the local attack requirements and availability-only impact of the flaw. No Red Hat products are affected by this vulnerability: all Red Hat Enterprise Linux and Red Hat In-Vehicle OS kernel and kernel-rt update streams were evaluated and marked not affected because the vulnerable code is not present in the shipped kernel packages.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.