In the batman‑adv networking module of the Linux kernel, a bug in batadv_get_vid() can trigger a use‑after‑free when the helper function pskb_may_pull() reallocates the socket buffer. Pointers that were saved to the old buffer become dangling, so subsequent use corrupts kernel memory. This type of fault can lead to a system crash or, if attacker input can control the freed region, it may be exploitable for privilege escalation over the kernel.

Any Linux kernel build that includes the batman‑adv module is potentially affected. The CVE does not list specific kernel versions, so any configuration that loads batman‑adv remains at risk until the patch is applied.

The vulnerability has a CVSS score of 8.8, indicating high severity. The EPSS score is below 1%, suggesting a very low exploitation probability at present. It is not listed in the CISA KEV catalog. The likely attack vector is network‑based, requiring an attacker to inject or manipulate traffic processed by batman‑adv. The risk remains if no patch or module removal is performed, though active exploitation appears uncommon.