CVE-2026-80599 in Linux
Summary
by MITRE • 08/28/2026
In the Linux kernel, the following vulnerability has been resolved:
batman-adv: dat: ensure accessible eth_hdr proto field
When batadv_get_vid() accesses the proto field of the ethernet header, it is not checking if the data itself is accessible. The caller is responsible for it. But in contrast to other call sites, batadv_dat_get_vid() and its caller didn't make sure this is true. This could have caused an out-of-bounds access.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/28/2026
The vulnerability identified within the Linux kernel's BATMAN-ADV (B.A.T.M.A.N.-Advanced) module represents a critical memory safety issue rooted in improper bounds checking during network packet processing. Specifically, the function batadv_get_vid() is designed to extract the Virtual LAN Identifier from an Ethernet header by accessing its protocol field. While this operation is standard for parsing network frames, the implementation failed to verify that the underlying data buffer was sufficiently large and accessible before attempting to read the proto field. In typical kernel networking stacks, it is often assumed or enforced at higher layers that packet headers are valid; however, in this specific code path involving batadv_dat_get_vid() and its caller, this assumption was not rigorously upheld compared to other call sites within the same module. This inconsistency creates a scenario where malformed or truncated packets can trigger an out-of-bounds memory access when the kernel attempts to read beyond the allocated buffer boundaries.
From a technical perspective, this flaw is classified as CWE-125: Out-of-Bounds Read, which falls under the broader category of Improper Limitation of a Resource's Accessibility (CWE-787). The root cause lies in the lack of explicit length validation prior to memory dereference operations. When batadv_dat_get_vid() invokes batadv_get_vid(), it relies on the caller to ensure data integrity, but this responsibility was not correctly implemented for this specific entry point. Consequently, if a malicious actor or even a benign network anomaly provides a packet with an Ethernet header shorter than expected, the kernel will attempt to read memory locations that are outside the valid range of the current buffer. This can lead to unpredictable behavior, including data leakage of sensitive kernel information contained in adjacent memory regions, system crashes due to segmentation faults, or potential exploitation vectors if the out-of-bounds read influences subsequent control flow decisions.
The operational impact of this vulnerability is significant for network infrastructure relying on BATMAN-ADV mesh networking protocols. An attacker capable of injecting crafted packets into the network path could exploit this flaw to cause a denial of service by crashing the kernel, effectively disrupting connectivity for all nodes in the mesh. Furthermore, depending on the memory layout and what data resides adjacent to the packet buffer, an out-of-bounds read might allow an adversary to exfiltrate sensitive information from the kernel's virtual address space. This aligns with ATT&CK technique T1082: System Information Discovery, as reading arbitrary kernel memory can reveal details about system configuration, loaded modules, or other security-critical data structures that could facilitate further attacks.
Mitigation for this issue primarily involves applying the specific patch released by the Linux kernel maintainers to update the BATMAN-ADV module. Administrators should ensure their systems are updated with the latest stable kernel version containing this fix. In environments where immediate patching is not feasible, network segmentation and strict ingress filtering can help mitigate risk by preventing untrusted or malformed packets from reaching the affected interfaces. Additionally, enabling Kernel Address Sanitizer (KASAN) in development or testing environments would have likely detected this out-of-bounds access during code review or QA phases, highlighting the importance of rigorous static analysis and runtime memory safety tools in kernel development to prevent such logical errors from reaching production systems.