The vulnerability occurs when batman‑adv accesses skb->data after the buffer may have been reallocated by pskb_may_pull(), leading to a use‑after‑free that can corrupt kernel memory. This flaw, identified as CWE‑825, could allow a local attacker to trigger arbitrary code execution or cause a kernel panic, effectively achieving privilege escalation.

All Linux kernel versions that include the batman‑adv module without the recent patch are affected; the flaw is present across distributions that ship the kernel with batman‑adv support. Users operating those kernels should assess whether they use batman‑adv networking on any device.

Because the bug requires manipulating batman‑adv packets to trigger a buffer reallocation, the attack vector is local and not immediately available remotely unless another vulnerability allows injection of such frames. The EPSS score of < 1% and the fact that it is not listed in the CISA KEV catalog suggest limited current exploitation attempts, but the severity of a kernel use‑after‑free means a potential local attacker could achieve privilege escalation. The CVSS score of 9.8 indicates the vulnerability is high risk. The expected exploit path involves sending specially crafted batman‑adv frames that force skb reallocation and dereference an old pointer, leading to code execution or a denial of service.