The Linux kernel’s batman-adv implementation allows the function batadv_get_vid() to use pskb_may_pull(), which can realloc the socket buffer behind an skb. If a pointer to data in the skb is not updated after this realloc, a use-after-free condition can occur, potentially enabling an attacker to corrupt memory or execute arbitrary code.

All Linux kernel builds that include the batman-adv module are potentially affected. No specific kernel versions or submodules are listed, so any kernel with batman-adv enabled may be vulnerable.

Use-after-free flaws are typically high severity because they allow memory corruption and can lead to privilege escalation or remote code execution. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, but the lack of a public patch or workaround indicates a significant risk if the issue remains unmitigated. An attacker would need to influence batman-adv traffic to trigger the realloc, but once triggered, control over the freed memory could be leveraged.