CVE-2026-72227 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
batman-adv: mcast: avoid OOB read of num_dests header
Before the access to struct batadv_tvlv_mcast_tracker's num_dests, it is attempted to check whether enough space is actually in the network header. But instead of using offsetofend() to check for the whole size (2) which must be accessible, offsetof() of is called. The latter is always returning 0. The comparison with the network header length will always return that enough data is available - even when only 1 or 0 bytes are accessible.
Instead of using offsetofend(), use the more common check for the whole header.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/15/2026
The vulnerability in question affects the batman-adv kernel module, which implements the Batman Advanced routing protocol for wireless mesh networks. This specific issue represents a buffer overflow vulnerability that could potentially allow attackers to read beyond the bounds of allocated memory regions. The flaw exists within the multicast handling code where the system attempts to validate that sufficient data is available in network headers before processing multicast tracker information. The vulnerability stems from an incorrect implementation of bounds checking logic that fundamentally undermines the security of the multicast packet processing routine.
The technical flaw manifests when the kernel code tries to verify that enough space exists in the network header to safely access the num_dests field within the batadv_tvlv_mcast_tracker structure. Instead of properly calculating the total required space using offsetofend(), which would determine the end offset of the entire header structure including all fields, the implementation incorrectly uses offsetof() which only returns the offset of the specific field within the structure. This fundamental error causes offsetof() to always return zero regardless of the actual header size, leading to a false positive in the bounds checking routine and allowing out-of-bounds memory reads.
The operational impact of this vulnerability extends beyond simple memory corruption issues as it could potentially enable attackers to extract sensitive information from kernel memory space through carefully crafted multicast packets. When an attacker sends malformed multicast traffic that triggers this code path, they can cause the system to read uninitialized or previously used memory locations that may contain kernel data structures, credentials, or other confidential information. This represents a classic out-of-bounds read vulnerability that could be exploited for information disclosure attacks and potentially escalation of privileges in certain scenarios.
This vulnerability maps directly to CWE-125 Out-of-Bounds Read as identified by the Common Weakness Enumeration catalog, which specifically addresses situations where programs access memory beyond the boundaries of allocated buffers. The issue also aligns with ATT&CK technique T1059.007 Command and Scripting Interpreter: PowerShell, though more specifically relates to kernel-level exploitation techniques under T1203 Exploitation for Client Execution or T1068 Exploitation for Privilege Escalation depending on the attack vector. The fix implemented addresses the root cause by replacing the incorrect offsetof() function call with offsetofend() which properly calculates the total header size needed for safe access, thereby preventing the out-of-bounds read condition and ensuring that all header data is validated against actual available network buffer space before processing.
The resolution of this vulnerability through proper bounds checking mechanisms demonstrates the critical importance of accurate memory management in kernel-space code. This type of error frequently occurs in complex networking protocols where multiple data structures must be carefully validated against incoming packet data. The fix ensures that the multicast tracking functionality correctly validates header lengths before attempting to access any fields within the structure, preventing both read and potential write operations beyond allocated buffer boundaries. This correction maintains the integrity of kernel memory management while preserving the legitimate functionality of the batman-adv multicast processing capabilities essential for wireless mesh network operation.