batman‑adv, a network mesh driver in the Linux kernel, mistakenly cached an unowned originator pointer within the BAT IV neighbor state. When the neighbor table was purged, this pointer could refer to memory that had already been freed or repurposed. An attacker who can influence batman‑adv traffic in a way that causes the stale pointer to be dereferenced may trigger kernel memory corruption. Because the corruption occurs in privileged kernel space, exploitation could potentially lead to arbitrary code execution with full system privileges. The flaw involves an improper memory management pattern (CWE‑825).

All Linux kernel versions that include the unpatched batman‑adv implementation are affected, as the issue exists before the patch that removes the auxiliary originator pointer from the neighbor state. The vulnerability is specific to the batman‑adv kernel module and does not affect user‑space applications. No exact kernel release numbers are listed, so all kernels from the first introduction of batman‑adv up to the latest stable release before the hotfix are potentially impacted.

The EPSS score of less than 1% indicates a very low probability of exploitation in the wild, and it is not listed in the CISA KEV catalog. Theoretical severity is high, as reflected by a CVSS score of 8.8, insofar as the bug permits kernel memory corruption that might enable privilege escalation, but evidence of a working exploit is lacking. The attack vector, inferred from the description, involves crafting network packets that the batman‑adv driver processes, typically bound to local or untrusted network interfaces; thus the vulnerability requires local or network‑level access to trigger. No publicly available exploits have been found, so the risk remains primarily theoretical until proof‑of‑concept code appears.