CVE-2026-72235

HighCVSS 8.8/10Last modified Oct 16, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

batman-adv: retrieve ethhdr after potential skb realloc on RX

pskb_may_pull() in batadv_interface_rx() could reallocate the buffer behind the skb. Variables which were pointing to the old buffer need to be reassigned to avoid an use-after-free.

This was done correctly for the VLAN header but missed for the ethernet header which is later used for the TT and AP isolation handling.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
LinuxLinux>= c6c8fea29769d998d94fcec9b9f14d4b52b349d3, < 6e189f14d1ea28db212b9d70a02131a7ce518012; >= c6c8fea29769d998d94fcec9b9f14d4b52b349d3, < a1820344b180cb55af748f102bc536b5c93164db; >= c6c8fea29769d998d94fcec9b9f14d4b52b349d3, < 6abf73589bed3f27ee240c08108feb72bed0b9c6; >= c6c8fea29769d998d94fcec9b9f14d4b52b349d3, < f19259395b44af67f3c274e34237c295b526b859; >= c6c8fea29769d998d94fcec9b9f14d4b52b349d3, < 2cefa5141cab8ec1e4b24cf585958b13f2e3049d; >= c6c8fea29769d998d94fcec9b9f14d4b52b349d3, < 85a71a81854e0e191ad0e533eabb4eff54866feb; >= c6c8fea29769d998d94fcec9b9f14d4b52b349d3, < b031fc97e1993d29d6c3a0e86a99140528cf31e8; >= c6c8fea29769d998d94fcec9b9f14d4b52b349d3, < 035e1fed892d3d06002a73ff73668f618a514644
LinuxLinux2.6.38

References

Timeline

Published
Aug 15, 2026
Last modified
Oct 16, 2026
NVD status
Received

Related CVEs from 2026

CVE-2026-72236In the Linux kernel, the following vulnerability has been resolved: s390/perf_cpum_cf: Add missing array_index_nospec() to __hw_perf_event_CVE-2026-72237In the Linux kernel, the following vulnerability has been resolved: perf/x86/amd/brs: Fix kernel address leakage A user-only branch stack CVE-2026-72238In the Linux kernel, the following vulnerability has been resolved: x86/boot: Validate console=uart8250 baud rate to fix early boot hang WCVE-2026-722399.3In the Linux kernel, the following vulnerability has been resolved: x86/virt/sev: Revert "Drop WBINVD before setting MSR_AMD64_SYSCFG_SNP_ECVE-2026-72247.3A security flaw has been discovered in SourceCodester Pizzafy Ecommerce System 1.0. This affects the function delete_cart of the file /adminCVE-2026-72240In the Linux kernel, the following vulnerability has been resolved: mfd: sm501: Fix reference leak on failed device registration When platCVE-2026-72241In the Linux kernel, the following vulnerability has been resolved: leds: uleds: Fix potential buffer overread The name string supplied byCVE-2026-722427.5In the Linux kernel, the following vulnerability has been resolved: selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() seCVE-2026-722438.4In the Linux kernel, the following vulnerability has been resolved: selinux: check connect-related permissions on TCP Fast Open Similar toCVE-2026-722447.8In the Linux kernel, the following vulnerability has been resolved: gpu/buddy: bail out of try_harder when alignment cannot be honoured ThCVE-2026-72245In the Linux kernel, the following vulnerability has been resolved: gpu: host1x: Fix device reference leak in host1x_device_parse_dt() erroCVE-2026-722477.5In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conncount: fix zone comparison in tuple dedup The "alrea
CVE-2026-72235: High severity, CVSS 8.8 | Vulnix