CVE-2026-80601

A flaw was found in the batman-adv (Better Approach To Mobile Ad-hoc Networking - Advanced) module of the Linux kernel. When the pskb_may_pull() function is called by batadv_get_vid(), it can reallocate the buffer, causing variables to point to a freed memory region. This use-after-free vulnerability could allow a local attacker to cause a denial of service or potentially execute arbitrary code.

A moderate-severity use-after-free flaw was found in the Linux kernel's batman-adv (Better Approach To Mobile Ad-hoc Networking - Advanced) gateway handling code. When processing packets on a system using the batman-adv mesh protocol, the pskb_may_pull() call made by batadv_get_vid() can reallocate the buffer behind the skb, leaving pointers that were acquired before the reallocation referencing freed memory. This use-after-free is most likely to cause a kernel crash and denial of service; the upstream description also notes the theoretical potential for arbitrary code execution, although reliably exploiting a kernel use-after-free requires significant effort and precise timing. Red Hat Product Security rates this flaw as Moderate severity with a CVSS 3.1 score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), reflecting a local attack vector with availability-only impact, which is substantially lower than the CVEORG score of 8.8 (Important, CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). All Red Hat Enterprise Linux and Red Hat In-Vehicle OS kernel and kernel-rt streams are not affected by this flaw because the vulnerable code is not present in the shipped kernel builds.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.