Description

In the Linux kernel, the following vulnerability has been resolved: batman-adv: dat: ensure accessible eth_hdr proto field When batadv_get_vid() accesses the proto field of the ethernet header, it is not checking if the data itself is accessible. The caller is responsible for it. But in contrast to other call sites, batadv_dat_get_vid() and its caller didn't make sure this is true. This could have caused an out-of-bounds access.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-08-28T08:16:43.700Z",
  "pubdate": "2026-08-28T08:16:43.700Z",
  "executiveSummary": "A vulnerability exists in the batman-adv kernel module, specifically within the Distributed ARP Table (DAT) component.\nThe flaw is identified as an out-of-bounds (OOB) memory access resulting from insufficient validation of packet data boundaries.\nThis vulnerability occurs when the system processes an Ethernet header without verifying that the necessary memory offsets for the 'proto' field are reachable within the sk_buff data buffer.\nThe impact includes potential kernel memory corruption, system instability, or a denial-of-service (DoS) condition if an attacker sends malformed packets.\nThe vulnerability is exposed to network-adjacent attackers who can inject crafted packets into the batman-adv interface.\nSuccessful exploitation requires the attacker to transmit packets where the Ethernet frame structure is truncated or malformed, triggering the kernel to read memory beyond the allocated sk_buff buffer.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper handling of the sk_buff structure within the batadv_get_vid() function. When processing incoming traffic, the batman-adv protocol stack calls batadv_get_vid() to retrieve the Virtual LAN Identifier (VLAN ID) from the ethernet header.\nIn the affected implementation, the code accesses the Ethernet header's 'proto' field (the EtherType/802.1Q tag location) without confirming that the buffer contains sufficient data to encompass this header field. While other components within the batman-adv stack correctly perform boundary checks before invoking helper functions, the batadv_dat_get_vid() call site fails to validate the accessibility of the required memory range.\nThe attack flow initiates when a malicious actor transmits a deliberately malformed Ethernet frame to a node running the batman-adv protocol. By sending a frame that is shorter than a standard Ethernet header, the attacker forces the kernel to perform an out-of-bounds read operation when the code attempts to extract the protocol identifier. Since the buffer pointer addresses memory that is outside the bounds of the provided sk_buff data, the CPU performs a read from an arbitrary location in kernel memory adjacent to the packet buffer.\nThis behavior leads to a kernel-level memory access violation. Depending on the memory layout and the kernel configuration (such as KASAN being enabled or disabled), this can result in a system crash (kernel panic) or an information leak, where sensitive kernel stack or heap data could be read if the return value of the function is processed in a way that exposes it to userspace.\nThe vulnerability is localized to the DAT (Distributed ARP Table) management logic. Because the validation is performed by the caller, the lack of input sanitization in the DAT path allows untrusted network traffic to reach the vulnerable function without adequate boundary enforcement. This bypasses the typical security assumptions of the stack, which expect the skb data to be correctly pulled and aligned before header inspection. This flaw affects the batman-adv module within the Linux kernel, requiring no special privileges or authentication from the attacker, provided they have network-level access to the mesh or the node itself."
}