This vulnerability, classified as CWE-125, is a buffer over‑read in the batman‑adv networking component of the Linux kernel. By attaching an eBPF TC hook that truncates a packet and redirects it to a batadv interface, a local user can cause the code to assume a minimum Ethernet header length of ETH_HLEN bytes and then read past the end of the buffer. The out‑of‑bounds read could expose sensitive kernel memory contents to the local attacker, raising the risk of information disclosure. The data do not explicitly state a code‑execution path; any escalation beyond disclosure is inferred from the nature of the memory read but is not confirmed by the description.

All Linux kernel binaries that employ the standard batadv path and have not incorporated the commit adding the minimum‑header check are potentially affected. This includes every distribution‑supplied kernel version released before the patch was integrated. No specific version list is supplied, so all kernels prior to the commit remain susceptible.

The flaw can only be triggered by a local user who has the privilege to attach eBPF TC hooks, a capability normally restricted to root or users with elevated rights. While the read may reveal kernel data, it does not provide an immediate code‑execution vector; further exploitation for privilege escalation is inferred but not documented. The CVSS score of 7.8 and an EPSS score of <1% indicate a high‑severity issue with a low probability of public exploitation. The vulnerability is not listed in the CISA KEV catalog, suggesting no known exploits at the time of this analysis. Systems exposing batadv interfaces and allowing eBPF TC configuration should treat this as a significant local information disclosure risk.