---
id: CVE-2026-80600
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  batman-adv: dat: acquire ARP hw source only after skb realloc

  The pskb_may_pull() called by batadv_get_vid() could reallocate the buffer
  behind the skb
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  batman-adv: dat: acquire ARP hw source only after skb realloc

  The pskb_may_pull() called by batadv_get_vid() could reallocate the buffer
  behind the skb. Variables whic…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
published: '2026-08-28'
updated: '2026-08-29'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-80600'
references:
  - url: 'https://git.kernel.org/stable/c/01678c53a7717a748aee388b6839e7b9761d641c'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/059a70e1d12d6d99310e0599d37b0323557569a8'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/3404be97b940a9b1ae1aea5fdbc6cdbbe9cd5146'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/3b4c70c40f2e135a50cd38fc61c7d23a296a9981'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/48067b2ae4504500a7093d9e1e16b42e70330480'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/86aa79b43e5b561fd3648891165bd7313b541315'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/a82fc217cb7a447313c76ebf9f09b100771b0ddf'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/d755cd001fa2c248e186c1fc3df3d11d97dc843c'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
epss: 0.00506
epssPercentile: 0.42265
ingestedAt: '2026-08-29T21:42:37.014Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

batman-adv: dat: acquire ARP hw source only after skb realloc

The pskb_may_pull() called by batadv_get_vid() could reallocate the buffer
behind the skb. Variables which were pointing to the old buffer need to be
reassigned to avoid an use-after-free.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.