---
id: CVE-2026-72234
title: 'batman-adv: access unicast_ttvn skb->data only after skb realloc'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  batman-adv: access unicast_ttvn skb->data only after skb realloc

  The pskb_may_pull() called by batadv_get_vid() could reallocate the buffer
  behind the skb. Variables w…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= c018ad3de61a1dc4194879a53e5559e094aa7b1a <
    aa9558af859934f24717d4bab97d61004f91a736
  - >-
    Linux >= c018ad3de61a1dc4194879a53e5559e094aa7b1a <
    9c2c05629e46c1fd43931506d41c56a885a98eb4
  - >-
    Linux >= c018ad3de61a1dc4194879a53e5559e094aa7b1a <
    7b162b36de750565404cd3b98315706622c6974f
  - >-
    Linux >= c018ad3de61a1dc4194879a53e5559e094aa7b1a <
    ed90eb5c68420cdfe67ec1f773324198d2ef6f50
  - >-
    Linux >= c018ad3de61a1dc4194879a53e5559e094aa7b1a <
    979175834a699ccc3c4c0b0ba60ecae0f135a587
  - >-
    Linux >= c018ad3de61a1dc4194879a53e5559e094aa7b1a <
    b8afcf799b2cc92c41beebd029e53ed18960184a
  - >-
    Linux >= c018ad3de61a1dc4194879a53e5559e094aa7b1a <
    9a7b7248798123efbd5fafe58461d57c7cc718af
  - >-
    Linux >= c018ad3de61a1dc4194879a53e5559e094aa7b1a <
    7141990add3f75436f2933cb310654cad3b1e3e9
  - Linux 3.13
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-10-16T18:44:38.054664Z'
published: '2026-08-15'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T18:45:03.804Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-72234'
references:
  - url: 'https://git.kernel.org/stable/c/aa9558af859934f24717d4bab97d61004f91a736'
  - url: 'https://git.kernel.org/stable/c/9c2c05629e46c1fd43931506d41c56a885a98eb4'
  - url: 'https://git.kernel.org/stable/c/7b162b36de750565404cd3b98315706622c6974f'
  - url: 'https://git.kernel.org/stable/c/ed90eb5c68420cdfe67ec1f773324198d2ef6f50'
  - url: 'https://git.kernel.org/stable/c/979175834a699ccc3c4c0b0ba60ecae0f135a587'
  - url: 'https://git.kernel.org/stable/c/b8afcf799b2cc92c41beebd029e53ed18960184a'
  - url: 'https://git.kernel.org/stable/c/9a7b7248798123efbd5fafe58461d57c7cc718af'
  - url: 'https://git.kernel.org/stable/c/7141990add3f75436f2933cb310654cad3b1e3e9'
tags:
  - cve.org
epss: 0.00734
epssPercentile: 0.53476
ingestedAt: '2026-10-16T19:46:24.419Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

batman-adv: access unicast_ttvn skb->data only after skb realloc

The pskb_may_pull() called by batadv_get_vid() could reallocate the buffer
behind the skb. Variables which were pointing to the old buffer need to be
reassigned to avoid an use-after-free.

This was done correctly for the ethernet header but missed for the
unicast_packet pointer.

## Affected

- `Linux >= c018ad3de61a1dc4194879a53e5559e094aa7b1a < aa9558af859934f24717d4bab97d61004f91a736`
- `Linux >= c018ad3de61a1dc4194879a53e5559e094aa7b1a < 9c2c05629e46c1fd43931506d41c56a885a98eb4`
- `Linux >= c018ad3de61a1dc4194879a53e5559e094aa7b1a < 7b162b36de750565404cd3b98315706622c6974f`
- `Linux >= c018ad3de61a1dc4194879a53e5559e094aa7b1a < ed90eb5c68420cdfe67ec1f773324198d2ef6f50`
- `Linux >= c018ad3de61a1dc4194879a53e5559e094aa7b1a < 979175834a699ccc3c4c0b0ba60ecae0f135a587`
- `Linux >= c018ad3de61a1dc4194879a53e5559e094aa7b1a < b8afcf799b2cc92c41beebd029e53ed18960184a`
- `Linux >= c018ad3de61a1dc4194879a53e5559e094aa7b1a < 9a7b7248798123efbd5fafe58461d57c7cc718af`
- `Linux >= c018ad3de61a1dc4194879a53e5559e094aa7b1a < 7141990add3f75436f2933cb310654cad3b1e3e9`
- `Linux 3.13`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.