{ "schema_version": "1.6.1", "id": "RPI-CVE-2026-72232", "modified": "2026-10-09T11:39:44Z", "upstream": [ "CVE-2026-72232" ], "published": "2026-08-15T06:04:33Z", "summary": "batman-adv: ensure minimal ethernet header on TX", "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nbatman-adv: ensure minimal ethernet header on TX\n\nAs documented in commit 8bd67ebb50c0 (\"net: bridge: xmit: make sure we have\nat least eth header len bytes\"), it is possible by for a local user with\neBPF TC hook access to attach a tc filter which truncates the packet and\nredirects to an batadv interface. But the code assumes that at least\nETH_HLEN bytes are available and thus might read outside of the available\nbuffer.\n\nThe batadv_interface_tx() must therefore always check itself if enough data\nis available for the ethernet header and don't rely on min_header_len.", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "affected": [ { "package": { "ecosystem": "Raspberry Pi OS:12", "name": "linux" }, "versions": [ "1:6.1.47-1+rpt4" ], "ecosystem_specific": { "binaries": [ { "binary_name": "linux-image-6.1.0-rpi3-rpi-2712", "binary_version": "1:6.1.47-1+rpt4" }, { "binary_name": "linux-image-6.1.0-rpi3-rpi-v6", "binary_version": "1:6.1.47-1+rpt4" }, { "binary_name": "linux-image-6.1.0-rpi3-rpi-v7", "binary_version": "1:6.1.47-1+rpt4" }, { "binary_name": "linux-image-6.1.0-rpi3-rpi-v7l", "binary_version": "1:6.1.47-1+rpt4" }, { "binary_name": "linux-image-6.1.0-rpi3-rpi-v8", "binary_version": "1:6.1.47-1+rpt4" } ] }, "database_specific": { "per_version": { "1:6.1.47-1+rpt4": { "linux_commit": "655fc658a15ae7a6f37103754adb39ba52a9a14e", "upstream_version": "6.1.47", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.1.178", "compiled_filter": false } } } }, { "package": { "ecosystem": "Raspberry Pi OS:13", "name": "linux" }, "versions": [ "1:6.18.29-1+rpt1", "1:6.18.33-1+rpt1", "1:6.18.34-1+rpt1", "1:6.18.39-1+rpt1" ], "ecosystem_specific": { "binaries": [ { "binary_name": "linux-image-6.18.29+rpt-rpi-2712", "binary_version": "1:6.18.29-1+rpt1" }, { "binary_name": "linux-image-6.18.29+rpt-rpi-v6", "binary_version": "1:6.18.29-1+rpt1" }, { "binary_name": "linux-image-6.18.29+rpt-rpi-v7", "binary_version": "1:6.18.29-1+rpt1" }, { "binary_name": "linux-image-6.18.29+rpt-rpi-v8", "binary_version": "1:6.18.29-1+rpt1" }, { "binary_name": "linux-image-6.18.29+rpt-rpi-v8-rt", "binary_version": "1:6.18.29-1+rpt1" }, { "binary_name": "linux-image-6.18.33+rpt-rpi-2712", "binary_version": "1:6.18.33-1+rpt1" }, { "binary_name": "linux-image-6.18.33+rpt-rpi-v6", "binary_version": "1:6.18.33-1+rpt1" }, { "binary_name": "linux-image-6.18.33+rpt-rpi-v7", "binary_version": "1:6.18.33-1+rpt1" }, { "binary_name": "linux-image-6.18.33+rpt-rpi-v8", "binary_version": "1:6.18.33-1+rpt1" }, { "binary_name": "linux-image-6.18.33+rpt-rpi-v8-rt", "binary_version": "1:6.18.33-1+rpt1" }, { "binary_name": "linux-image-6.18.34+rpt-rpi-2712", "binary_version": "1:6.18.34-1+rpt1" }, { "binary_name": "linux-image-6.18.34+rpt-rpi-v6", "binary_version": "1:6.18.34-1+rpt1" }, { "binary_name": "linux-image-6.18.34+rpt-rpi-v7", "binary_version": "1:6.18.34-1+rpt1" }, { "binary_name": "linux-image-6.18.34+rpt-rpi-v8", "binary_version": "1:6.18.34-1+rpt1" }, { "binary_name": "linux-image-6.18.34+rpt-rpi-v8-rt", "binary_version": "1:6.18.34-1+rpt1" }, { "binary_name": "linux-image-6.18.39+rpt-rpi-2712", "binary_version": "1:6.18.39-1+rpt1" }, { "binary_name": "linux-image-6.18.39+rpt-rpi-v6", "binary_version": "1:6.18.39-1+rpt1" }, { "binary_name": "linux-image-6.18.39+rpt-rpi-v7", "binary_version": "1:6.18.39-1+rpt1" }, { "binary_name": "linux-image-6.18.39+rpt-rpi-v8", "binary_version": "1:6.18.39-1+rpt1" }, { "binary_name": "linux-image-6.18.39+rpt-rpi-v8-rt", "binary_version": "1:6.18.39-1+rpt1" } ] }, "database_specific": { "per_version": { "1:6.18.29-1+rpt1": { "linux_commit": "66318c5b5cd8145a662303af12ed39ac07eb27cc", "upstream_version": "6.18.29", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.18.40" }, "1:6.18.33-1+rpt1": { "linux_commit": "95b85bebbedcaedfa7ca79116ed38b7376fba412", "upstream_version": "6.18.33", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.18.40" }, "1:6.18.34-1+rpt1": { "linux_commit": "c8c7494100e99ee05b11aaa4f0588a223a63d1af", "upstream_version": "6.18.34", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.18.40" }, "1:6.18.39-1+rpt1": { "linux_commit": "60ea684a8ace97bb0db1a16e20753bdd6ab371ff", "upstream_version": "6.18.39", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.18.40" } } } } ], "references": [ { "type": "ADVISORY", "url": "https://www.cve.org/CVERecord?id=CVE-2026-72232" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/58799078afebd5115e052bf69ad6697f9759dd6f" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/38cd10b0aeec755d89f78722a2b83f4088ff0cb0" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/811fea37620f2097955d95ce81cfdba03fd30f1b" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/e6640923afee619d9fa82b07394dc9498e202304" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/6b4f521e01257387906f8b969ad3450d8208d4e2" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/9e16b6751a8206de0b865d99bb02771e6751d12d" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/dbeb4145d9778f922f459935da9a027750765a69" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/49df66b7993c80b80c7eb9a84ba5b3410c8296a0" } ], "database_specific": { "source": "https://git.kernel.org/pub/scm/linux/security/vulns.git", "upstream_modified": "2026-08-17T05:50:24Z", "severity": { "source": "kernel CNA", "cvss_v3_score": 7.8, "cvss_v3_severity": "High", "scenario": "AV:L - Reachable only via local ndo_start_xmit on a batadv netdev after a TC/eBPF program (bpf_redirect/bpf_clone_redirect or mirred) truncates an skb below ETH_HLEN; there is no credible remote or adjacent path without local TC/BPF control.\nAC:L - An attacker with CAP_NET_ADMIN can reliably attach a TC clsact filter, shrink the skb (e.g. bpf_skb_adjust_room), and redirect to bat0; no race or victim state beyond attacker-controlled namespace setup is required.\nPR:L - Exploitation requires CAP_NET_ADMIN to attach TC/BPF programs and create/use a batadv interface; this capability is obtainable by unprivileged users inside user/network namespaces (unshare -Urn), not only init-namespace root.\nUI:N - No victim interaction is needed; the attacker triggers the bug by installing the TC filter and transmitting or test-running the crafted skb themselves.\nS:U - Impact remains within the kernel/network stack security authority (memory disclosure, mesh state corruption, crash); it does not by itself cross a VM, container, or IOMMU boundary.\nC:H - Missing ETH_HLEN validation causes an out-of-bounds read of up to 12 bytes past skb->tail via eth_hdr(), exposing adjacent slab/uninitialized kernel memory and enabling heap grooming for further exploitation.\nI:H - OOB-read ethernet header fields drive batadv_tt_local_add, DAT/ARP snooping, and mesh forwarding decisions, corrupting translation/routing state; kernel OOB reads are also commonly chained into arbitrary write primitives.\nA:H - Reading beyond the skb buffer can trigger kernel oops/panic (as seen in the analogous bridge/bpf_redirect syzbot reports) and enables repeated, attacker-controlled crashes on mesh nodes running batman-adv." } } }