CVE-2026-80600 in Linux
Summary
by MITRE • 08/28/2026
In the Linux kernel, the following vulnerability has been resolved:
batman-adv: dat: acquire ARP hw source only after skb realloc
The pskb_may_pull() called by batadv_get_vid() could reallocate the buffer behind the skb. Variables which were pointing to the old buffer need to be reassigned to avoid an use-after-free.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/28/2026
The Linux kernel vulnerability identified in the batman-adv module involves a critical memory management flaw within the Distributed ARP Table (DAT) implementation, specifically during the processing of Address Resolution Protocol packets. The core issue stems from improper handling of network buffer reallocation operations performed by the pskb_may_pull function. This function is invoked indirectly through batadv_get_vid to ensure that sufficient data is present in the socket buffer for subsequent parsing. When the required data extends beyond the current linear portion of the packet, pskb_may_pull may trigger a memory reallocation, creating a new buffer and copying the existing data into it while discarding or modifying the original buffer structure.
The technical flaw arises because certain variables were initialized to point directly to pointers within the old socket buffer before this potential reallocation occurred. Specifically, code paths that acquire hardware source addresses for ARP requests relied on these pre-cached pointer references. When pskb_may_pull reallocates the underlying memory, those cached pointers become stale and continue referencing freed or invalid memory regions rather than the newly allocated data structures. This discrepancy creates a classic use-after-free condition where the kernel attempts to read from or write to memory that is no longer validly mapped to the current packet context.
From an operational impact perspective, this vulnerability allows for potential denial of service conditions and arbitrary code execution if exploited by a malicious actor capable of injecting crafted network packets into the batman-adv mesh network environment. An attacker could craft specific ARP request frames designed to trigger the reallocation path while ensuring that subsequent operations access the stale pointers. Successful exploitation could lead to kernel panic due to invalid memory accesses, resulting in system instability and service interruption for all nodes participating in the BATMAN Advanced routing protocol. Furthermore, depending on the exact data accessed through these dangling pointers, an attacker might achieve information disclosure of sensitive kernel memory contents or escalate privileges by manipulating control flow structures stored near the affected buffer regions.
This vulnerability aligns with CWE-416, Use After Free, as it involves accessing memory after it has been freed due to improper pointer management during dynamic allocation changes. In terms of attack vectors and techniques, this flaw relates to ATT&CK technique T1059, Command and Scripting Interpreter, if leveraged for initial access via crafted packets in a networked environment, though the primary classification remains within memory corruption vulnerabilities typical of kernel-level exploits. The mitigation strategy implemented by the Linux community involves restructuring the code flow to ensure that any pointers derived from socket buffer data are refreshed immediately after calls to functions like pskb_may_pull that may alter the underlying memory layout. Developers must verify that all references to packet data are reacquired post-reallocation to maintain consistency between pointer values and actual memory locations, thereby eliminating the window of opportunity for use-after-free exploitation within the batman-adv DAT subsystem.