CVE-2026-72226 - Vulnerability Details

- batman-adv: tt: prevent TVLV OOB check overflow

Description

In the Linux kernel, the following vulnerability has been resolved:

batman-adv: tt: prevent TVLV OOB check overflow

A TT unicast TVLV contains the number of VLANs stored in it. This number is
an u16 and gets multiplied by the size of the struct
batadv_tvlv_tt_vlan_data (8 bytes). The size can therefore overflow the u16
used to store the tt_vlan_len. All additional safety checks to prevent
out-of-bounds access of the TVLV buffer are invalid due to this overflow.

Using size_t prevents this overflow and ensures that the safety checks
compare against the actual buffer requirements.

Published: 2026-08-15

Score: 9.8 Critical

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The bug lies in the batman-adv mesh driver when processing TT unicast frames that contain an out‑of‑bounds VLAN length. A 16‑bit counter is multiplied by an 8‑byte structure size, overflowing the 16‑bit field that holds the expected length of the VLAN data. The overflow silently weakens protection checks against buffer overflows, allowing an attacker to inject malformed payloads that can corrupt kernel memory or crash the kernel. This vulnerability is rooted in integer overflow and unsafe buffer bounds checks.

Affected Systems

Systems running the Linux kernel that include the batman‑adv driver—any distribution using the mainline kernel with batman‑adv enabled—are susceptible. No precise version list is supplied in the data; a kernel earlier than the commit that introduced the fix is at risk.

Risk and Exploitability

Because the bug propagates from malformed network frames processed by the kernel, the likely attack vector is a remote attacker sending crafted TT unicast packets through the mesh network. The CVSS score of 9.8 indicates critical severity, and the EPSS score of < 1% shows low exploitation likelihood as of now. Memory corruption in the kernel can lead to privilege escalation, and the vulnerability is not currently listed in CISA’s KEV catalog.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`7ea7b4a142758deaf46c1af0ca9ceca6dd55138b`	affected	< 0de12a4c4847f571d82a9cd96bc633eded41d7c6
`7ea7b4a142758deaf46c1af0ca9ceca6dd55138b`	affected	< d6ff4764ff784ede25f5c83a6f5883a74c93a5ea
`7ea7b4a142758deaf46c1af0ca9ceca6dd55138b`	affected	< 1898273c5dc8148267ef9f97cd2517a2822350e7
`7ea7b4a142758deaf46c1af0ca9ceca6dd55138b`	affected	< 604bd5042fbcd1ab9f7cd98fd847ec017aeede8a
`7ea7b4a142758deaf46c1af0ca9ceca6dd55138b`	affected	< 7319c0794f91be2734aac695794e7203606b49f8
`7ea7b4a142758deaf46c1af0ca9ceca6dd55138b`	affected	< 3256c05d5a9db34346eaf20f52dddde984852d77
`7ea7b4a142758deaf46c1af0ca9ceca6dd55138b`	affected	< 6222b443686525cb5a9b6a9cecf23b2e2ab23e2a
`7ea7b4a142758deaf46c1af0ca9ceca6dd55138b`	affected	< 7a581d9aaba8c82bd6177fa36b2588eea77f6e2b

Linux

affected

Version	Status	Constraints
`3.13`	affected	—
`0`	unaffected	< 3.13
`5.10.261`	unaffected	≤ 5.10.*
`5.15.212`	unaffected	≤ 5.15.*
`6.1.178`	unaffected	≤ 6.1.*
`6.6.145`	unaffected	≤ 6.6.*
`6.12.97`	unaffected	≤ 6.12.*
`6.18.40`	unaffected	≤ 6.18.*
`7.1.5`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[7ea7b4a142758deaf46c1af0ca9ceca6dd55138b,0de12a4c4847f571d82a9cd96bc633eded41d7c6)`	affected	code_commit	—
`[7ea7b4a142758deaf46c1af0ca9ceca6dd55138b,d6ff4764ff784ede25f5c83a6f5883a74c93a5ea)`	affected	code_commit	—
`[7ea7b4a142758deaf46c1af0ca9ceca6dd55138b,1898273c5dc8148267ef9f97cd2517a2822350e7)`	affected	code_commit	—
`[7ea7b4a142758deaf46c1af0ca9ceca6dd55138b,604bd5042fbcd1ab9f7cd98fd847ec017aeede8a)`	affected	code_commit	—
`[7ea7b4a142758deaf46c1af0ca9ceca6dd55138b,7319c0794f91be2734aac695794e7203606b49f8)`	affected	code_commit	—
`[7ea7b4a142758deaf46c1af0ca9ceca6dd55138b,3256c05d5a9db34346eaf20f52dddde984852d77)`	affected	code_commit	—
`[7ea7b4a142758deaf46c1af0ca9ceca6dd55138b,6222b443686525cb5a9b6a9cecf23b2e2ab23e2a)`	affected	code_commit	—
`[7ea7b4a142758deaf46c1af0ca9ceca6dd55138b,7a581d9aaba8c82bd6177fa36b2588eea77f6e2b)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`3.13`	affected	generic	—
`[0,3.13)`	unaffected	generic	—
`[5.10.261,5.11.0)`	unaffected	semver	—
`[5.15.212,5.16.0)`	unaffected	semver	—
`[6.1.178,6.2.0)`	unaffected	semver	—
`[6.6.145,6.7.0)`	unaffected	semver	—
`[6.12.97,6.13.0)`	unaffected	semver	—
`[6.18.40,6.19.0)`	unaffected	semver	—
`[7.1.5,7.2.0)`	unaffected	semver	—
`[7.2-rc3,*]`	unaffected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade to a Linux kernel version that includes the batman-adv TVLV overflow fix (commit 0de12a4c).
If immediate upgrade is not feasible, block or filter TT unicast frames that could carry malicious TVLV data at the network interface level.
After applying the patch or reconfiguring the driver, reboot the system or reload the batman-adv module to ensure the fix takes effect.

Generated by OpenCVE AI on August 17, 2026 at 19:01 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00704.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/0de12a4c4847f571d82a9cd96bc633eded41d7c6
https://git.kernel.org/stable/c/1898273c5dc8148267ef9f97cd2517a2822350e7
https://git.kernel.org/stable/c/3256c05d5a9db34346eaf20f52dddde984852d77
https://git.kernel.org/stable/c/604bd5042fbcd1ab9f7cd98fd847ec017aeede8a
https://git.kernel.org/stable/c/6222b443686525cb5a9b6a9cecf23b2e2ab23e2a
https://git.kernel.org/stable/c/7319c0794f91be2734aac695794e7203606b49f8
https://git.kernel.org/stable/c/7a581d9aaba8c82bd6177fa36b2588eea77f6e2b
https://git.kernel.org/stable/c/d6ff4764ff784ede25f5c83a6f5883a74c93a5ea
https://lore.kernel.org/linux-cve-announce/2026081548-CVE-2026-72226-87e0@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-72226
https://www.cve.org/CVERecord?id=CVE-2026-72226

History

Wed, 19 Aug 2026 00:15:00 +0000

Type	Values Removed	Values Added
References		https://lore.kernel.org/linux-cve-announce/2026081548-CVE-2026-72226-87e0@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-72226 https://www.cve.org/CVERecord?id=CVE-2026-72226
Metrics	threat_severity `None`	threat_severity `Moderate`

Mon, 17 Aug 2026 19:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-190 CWE-787

Mon, 17 Aug 2026 17:30:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-119 CWE-190

Mon, 17 Aug 2026 06:00:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Sat, 15 Aug 2026 10:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-119 CWE-190

Sat, 15 Aug 2026 06:00:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: batman-adv: tt: prevent TVLV OOB check overflow A TT unicast TVLV contains the number of VLANs stored in it. This number is an u16 and gets multiplied by the size of the struct batadv_tvlv_tt_vlan_data (8 bytes). The size can therefore overflow the u16 used to store the tt_vlan_len. All additional safety checks to prevent out-of-bounds access of the TVLV buffer are invalid due to this overflow. Using size_t prevents this overflow and ensures that the safety checks compare against the actual buffer requirements.
Title		batman-adv: tt: prevent TVLV OOB check overflow
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/0de12a4c4847f571d82a9cd96bc633eded41d7c6 https://git.kernel.org/stable/c/1898273c5dc8148267ef9f97cd2517a2822350e7 https://git.kernel.org/stable/c/3256c05d5a9db34346eaf20f52dddde984852d77 https://git.kernel.org/stable/c/604bd5042fbcd1ab9f7cd98fd847ec017aeede8a https://git.kernel.org/stable/c/6222b443686525cb5a9b6a9cecf23b2e2ab23e2a https://git.kernel.org/stable/c/7319c0794f91be2734aac695794e7203606b49f8 https://git.kernel.org/stable/c/7a581d9aaba8c82bd6177fa36b2588eea77f6e2b https://git.kernel.org/stable/c/d6ff4764ff784ede25f5c83a6f5883a74c93a5ea

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-08-15T05:54:18.285Z

Updated: 2026-08-17T05:41:46.404Z

Reserved: 2026-08-09T03:40:39.913Z

Link: CVE-2026-72226

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-08-15T06:21:49.383

Modified: 2026-08-17T06:18:23.773

Link: CVE-2026-72226

Redhat

Severity : Moderate

Publid Date: 2026-08-15T00:00:00Z

Links: CVE-2026-72226 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-17T19:15:06Z

Weaknesses

CWE-190
Integer Overflow or Wraparound
CWE-787
Out-of-bounds Write

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object