CVE-2026-72228 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
batman-adv: frag: fix primary_if leak on failed linearization
If the skb has a frag_list, it must be linearized before it can be split using skb_split(). But when this step failed, it must not only free the skb but also take care of the reference to the already found primary_if.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/15/2026
The vulnerability in question affects the batman-adv kernel module, which implements the B.A.T.M.A.N. routing protocol for wireless mesh networks. This specific issue represents a memory management flaw that occurs during packet processing when handling fragmented network traffic. The problem manifests in the fragment handling code path where the system attempts to linearize scatter-gather list structures before splitting packets, but fails to properly manage reference counting for network interface references when this operation encounters an error condition.
The technical root cause lies in improper resource cleanup following failed linearization operations within the packet processing pipeline. When the kernel encounters a socket buffer containing a fragment list structure, it must first convert this into a linear memory layout before performing packet splitting operations. However, if this linearization process fails due to insufficient memory or other constraints, the system enters an error handling path that inadequately manages the reference count for the primary network interface pointer. This results in a memory leak where the primary_if reference remains unreleased while the skb structure itself gets freed, creating a dangling reference condition.
The operational impact of this vulnerability extends beyond simple memory consumption issues, as it can lead to system instability and potential denial of service conditions within mesh network environments. Network traffic processing becomes increasingly unreliable as the leak accumulates over time, potentially causing the routing protocol to malfunction or crash entirely. The vulnerability specifically affects systems running Linux kernels with batman-adv support where wireless mesh networking is actively utilized, making it particularly relevant for enterprise and community mesh networks.
From a cybersecurity perspective, this vulnerability aligns with CWE-401, which describes improper handling of memory allocation failures and resource leaks. The flaw demonstrates poor error handling practices in kernel space memory management, where the system fails to maintain proper reference counting semantics during exceptional conditions. Attackers could potentially exploit this weakness to cause resource exhaustion or system instability through sustained network traffic patterns that consistently trigger the failure path.
Mitigation strategies should focus on applying the official kernel patch that ensures proper cleanup of primary_if references when linearization operations fail. System administrators should prioritize updating affected kernel versions and monitoring for memory consumption anomalies in mesh network environments. Additionally, implementing robust network traffic monitoring can help detect abnormal resource usage patterns that might indicate exploitation attempts. The fix requires careful attention to reference counting mechanisms and proper error path handling within the kernel's networking subsystem, particularly in areas dealing with packet fragmentation and wireless mesh routing protocols.
This vulnerability exemplifies the complexity of kernel security where seemingly minor resource management issues can cascade into significant system stability problems. The batman-adv module's design must account for all possible failure modes during packet processing, ensuring that reference counting remains consistent regardless of execution path taken. The ATT&CK framework categorizes this under privilege escalation and resource exhaustion techniques, as improper memory handling can lead to both denial of service conditions and potential privilege escalation opportunities in certain configurations.
Security teams should conduct thorough testing of patched kernel versions in production environments before deployment, particularly in mission-critical mesh network infrastructures where reliability is paramount. The vulnerability highlights the importance of comprehensive error handling in kernel modules, emphasizing that all code paths must properly account for resource cleanup even when operations fail unexpectedly. Regular security audits of kernel subsystems should include detailed analysis of reference counting and memory management patterns to prevent similar issues from emerging in other networking components.