CVE-2026-80600
Description
A flaw was found in the batman-adv module of the Linux kernel. This vulnerability occurs because the pskb_may_pull() function, when called by batadv_get_vid(), can reallocate a buffer. This causes variables to point to the previously freed memory, leading to a use-after-free condition. A local attacker could potentially exploit this to cause a denial of service or execute arbitrary code.
Statement
A moderate-severity use-after-free vulnerability was found in the batman-adv (Batman Advanced) mesh networking module of the Linux kernel. While processing ARP traffic for the Distributed ARP Table (DAT), the pskb_may_pull() call performed by batadv_get_vid() can reallocate the socket buffer (skb) backing data area; pointers into the old buffer, such as the one used to read the ARP hardware source address, are then left dangling, and dereferencing them results in a use-after-free. An attacker able to trigger this condition could cause a kernel crash (denial of service) or potentially execute arbitrary code. Red Hat rates this flaw as Moderate impact with a CVSS 3.1 base score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H); this differs significantly from the upstream CVE record's Critical score of 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), because Red Hat's assessment reflects the local attack requirements and availability-only impact of the flaw. No Red Hat products are affected by this vulnerability: all Red Hat Enterprise Linux and Red Hat In-Vehicle OS kernel and kernel-rt update streams were evaluated and marked not affected because the vulnerable code is not present in the shipped kernel packages.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.5 | N/A | 9.8 |
| Attack Vector | Local | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | Low | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | High |
| Integrity Impact | None | N/A | High |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
