---
id: CVE-2026-72232
title: 'batman-adv: ensure minimal ethernet header on TX'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  batman-adv: ensure minimal ethernet header on TX

  As documented in commit 8bd67ebb50c0 ("net: bridge: xmit: make sure we have
  at least eth header len bytes"), it is pos…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= c6c8fea29769d998d94fcec9b9f14d4b52b349d3 <
    58799078afebd5115e052bf69ad6697f9759dd6f
  - >-
    Linux >= c6c8fea29769d998d94fcec9b9f14d4b52b349d3 <
    38cd10b0aeec755d89f78722a2b83f4088ff0cb0
  - >-
    Linux >= c6c8fea29769d998d94fcec9b9f14d4b52b349d3 <
    811fea37620f2097955d95ce81cfdba03fd30f1b
  - >-
    Linux >= c6c8fea29769d998d94fcec9b9f14d4b52b349d3 <
    e6640923afee619d9fa82b07394dc9498e202304
  - >-
    Linux >= c6c8fea29769d998d94fcec9b9f14d4b52b349d3 <
    6b4f521e01257387906f8b969ad3450d8208d4e2
  - >-
    Linux >= c6c8fea29769d998d94fcec9b9f14d4b52b349d3 <
    9e16b6751a8206de0b865d99bb02771e6751d12d
  - >-
    Linux >= c6c8fea29769d998d94fcec9b9f14d4b52b349d3 <
    dbeb4145d9778f922f459935da9a027750765a69
  - >-
    Linux >= c6c8fea29769d998d94fcec9b9f14d4b52b349d3 <
    49df66b7993c80b80c7eb9a84ba5b3410c8296a0
  - Linux 2.6.38
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T18:44:26.055305Z'
published: '2026-08-15'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T18:45:03.394Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-72232'
references:
  - url: 'https://git.kernel.org/stable/c/58799078afebd5115e052bf69ad6697f9759dd6f'
  - url: 'https://git.kernel.org/stable/c/38cd10b0aeec755d89f78722a2b83f4088ff0cb0'
  - url: 'https://git.kernel.org/stable/c/811fea37620f2097955d95ce81cfdba03fd30f1b'
  - url: 'https://git.kernel.org/stable/c/e6640923afee619d9fa82b07394dc9498e202304'
  - url: 'https://git.kernel.org/stable/c/6b4f521e01257387906f8b969ad3450d8208d4e2'
  - url: 'https://git.kernel.org/stable/c/9e16b6751a8206de0b865d99bb02771e6751d12d'
  - url: 'https://git.kernel.org/stable/c/dbeb4145d9778f922f459935da9a027750765a69'
  - url: 'https://git.kernel.org/stable/c/49df66b7993c80b80c7eb9a84ba5b3410c8296a0'
tags:
  - cve.org
epss: 0.00156
epssPercentile: 0.04289
ingestedAt: '2026-10-16T19:46:24.420Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

batman-adv: ensure minimal ethernet header on TX

As documented in commit 8bd67ebb50c0 ("net: bridge: xmit: make sure we have
at least eth header len bytes"), it is possible by for a local user with
eBPF TC hook access to attach a tc filter which truncates the packet and
redirects to an batadv interface. But the code assumes that at least
ETH_HLEN bytes are available and thus might read outside of the available
buffer.

The batadv_interface_tx() must therefore always check itself if enough data
is available for the ethernet header and don't rely on min_header_len.

## Affected

- `Linux >= c6c8fea29769d998d94fcec9b9f14d4b52b349d3 < 58799078afebd5115e052bf69ad6697f9759dd6f`
- `Linux >= c6c8fea29769d998d94fcec9b9f14d4b52b349d3 < 38cd10b0aeec755d89f78722a2b83f4088ff0cb0`
- `Linux >= c6c8fea29769d998d94fcec9b9f14d4b52b349d3 < 811fea37620f2097955d95ce81cfdba03fd30f1b`
- `Linux >= c6c8fea29769d998d94fcec9b9f14d4b52b349d3 < e6640923afee619d9fa82b07394dc9498e202304`
- `Linux >= c6c8fea29769d998d94fcec9b9f14d4b52b349d3 < 6b4f521e01257387906f8b969ad3450d8208d4e2`
- `Linux >= c6c8fea29769d998d94fcec9b9f14d4b52b349d3 < 9e16b6751a8206de0b865d99bb02771e6751d12d`
- `Linux >= c6c8fea29769d998d94fcec9b9f14d4b52b349d3 < dbeb4145d9778f922f459935da9a027750765a69`
- `Linux >= c6c8fea29769d998d94fcec9b9f14d4b52b349d3 < 49df66b7993c80b80c7eb9a84ba5b3410c8296a0`
- `Linux 2.6.38`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.