The batman‑adv multicast handling in the Linux kernel contains a bounds‑check bug that allows an out‑of‑bounds read of the num_dests field in the batadv_tvlv_mcast_tracker structure. The check mistakenly uses offsetof instead of offsetofend, causing the length comparison to always succeed even when the packet is incomplete. The result is an unsolicited read of kernel memory, which can reveal sensitive data but does not directly enable code execution. The weakness corresponds to an out‑of‑bounds read vulnerability (CWE-125).

Linux kernel implementations that include the batman‑adv multicast driver and have not applied the patch commit that corrects the bounds check. The fix is included in all recent kernel releases; any kernel built from source before that commit is potentially affected. No specific version list is supplied in the advisory.

The CVSS score of 8.1 indicates high severity, yet the EPSS score is below 1 % and the vulnerability is not listed in CISA KEV, indicating a low probability of public exploitation. The flaw requires an attacker to be able to send malicious IPv4 multicast frames to a system that has the batman‑adv driver loaded. Based on the description, the likely attack vector is a local or network attacker who can reach the compromised host’s multicast interface. Exploitation would allow information disclosure from kernel memory, potentially aiding further attacks. The overall risk remains moderate, but the lack of an available exploit and the need for proximity keep the threat relatively low.