The batman‑adv kernel module contains a use‑after‑free flaw (CWE‑825) when processing received packets. A call to pskb_may_pull() in batadv_interface_rx() may reallocate the socket buffer behind the skb, leaving stale pointers to the Ethernet header unreassigned. This stale pointer is later dereferenced during TT and AP isolation handling, enabling memory corruption which an attacker could exploit to gain elevated privileges or crash the system.

All Linux kernel installations that include the batman‑adv virtual‑LAN extension are affected. The bug persists in any kernel version that has not incorporated the patched code, regardless of distribution.

The CVSS score of 8.8 indicates high severity; the EPSS score of < 1% shows a very low real‑world exploitation probability. The flaw likely requires a network attacker to send a specially crafted Ethernet frame to a batman‑adv‑enabled interface, limiting the surface to systems with reachable interfaces but potentially enabling remote privilege escalation if successful. The vulnerability is not listed in CISA KeV.