CVE-2026-72230 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
batman-adv: frag: free unfragmentable packet
The caller of batadv_frag_send_packet() assume that the skb provided to the function are always consumed. But the pre-check for an empty payload or the zero fragment size returned an error without any further actions.
A failed pre-check must use the same error handling code as the rest of the function.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/15/2026
The vulnerability in question affects the batman-adv kernel module, which implements the Better Approach to Mobile Ad-hoc Networking protocol for Linux wireless networks. This specific issue resides within the fragment handling mechanism of the protocol implementation where the batadv_frag_send_packet() function demonstrates improper error handling behavior. The flaw occurs when the function receives a packet that fails certain validation checks such as empty payload detection or zero fragment size verification, causing the function to return an error without properly managing the packet reference.
The technical root cause stems from inconsistent error handling practices within the fragment processing code path. When validation checks fail, the function should maintain consistent behavior by ensuring proper cleanup of resources regardless of the outcome. However, in this case, the pre-check logic returns immediately upon detecting invalid conditions without executing the same resource management code that would normally be executed for successful packet processing. This creates a memory management inconsistency where the original caller assumes all packets passed to batadv_frag_send_packet() are consumed and properly handled, leading to potential reference count mismatches or memory leaks.
The operational impact of this vulnerability manifests in scenarios involving mobile ad-hoc network communications where fragmented packets are processed through the batman-adv module. When a packet fails validation but doesn't trigger proper cleanup, it can lead to memory corruption issues or resource exhaustion over time. Attackers could potentially exploit this by crafting malicious packets that trigger the error path repeatedly, causing system instability or denial of service conditions within wireless networking environments. The vulnerability aligns with CWE-457: Use of Uninitialized Variables and CWE-129: Improper Validation of Array Index, as it involves improper handling of packet references and validation failure conditions.
This flaw represents a classic example of inconsistent error handling patterns that can be mapped to ATT&CK technique T1059.008 for execution through kernel modules and T1499.004 for network denial of service attacks. The vulnerability affects systems running Linux kernels with batman-adv support, particularly those implementing wireless mesh networking capabilities where the module is actively processing fragmented packets. The issue demonstrates poor defensive programming practices in kernel space where resource management must be deterministic regardless of execution path taken.
Mitigation strategies should focus on ensuring consistent error handling throughout the function by implementing proper cleanup routines for all code paths that exit early due to validation failures. The fix requires modifying batadv_frag_send_packet() to execute the same resource deallocation procedures whether validation succeeds or fails, maintaining the expected reference counting behavior that callers depend upon. This approach aligns with kernel security best practices and defensive programming principles that mandate predictable resource management in all execution paths of critical system components.