Description

In the Linux kernel, the following vulnerability has been resolved: batman-adv: dat: acquire ARP hw source only after skb realloc The pskb_may_pull() called by batadv_get_vid() could reallocate the buffer behind the skb. Variables which were pointing to the old buffer need to be reassigned to avoid an use-after-free.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-28T08:16:43.827Z",
  "pubdate": "2026-08-28T08:16:43.827Z",
  "executiveSummary": "A use-after-free vulnerability exists in the Distributed ARP Table (DAT) component of the batman-adv Linux kernel module.\nThe vulnerability arises due to unsafe memory handling during packet processing, specifically when reallocating skb (socket buffer) memory.\nSuccessful exploitation allows an attacker to trigger a use-after-free condition, which can lead to system crashes (Denial of Service), memory corruption, or potentially arbitrary code execution within the kernel context.\nThe flaw affects batman-adv and impacts systems utilizing this mesh networking protocol. The vulnerability is triggered during the ARP packet inspection process where a pointer to buffer memory becomes stale following a pskb_may_pull() operation.\nThis vulnerability requires no specific authentication, but the attacker must be able to inject or forward crafted ARP packets into the mesh network to trigger the reallocation process.",
  "technicalDetails": "The vulnerability is rooted in the improper management of memory pointers within the batman-adv DAT implementation. During the inspection of ARP packets, the function batadv_get_vid() performs a check using pskb_may_pull(). This function ensures that the required protocol headers are present in the linear part of the skb data buffer.\nWhen pskb_may_pull() determines that the existing linear buffer is insufficient, it reallocates the data buffer to provide additional space. Crucially, this reallocation process invalidates any existing pointers that reference the previous memory location of the packet data.\nIn the vulnerable implementation, the code extracts the ARP hardware source address from the packet before the potential reallocation occurs. Because the pointer to the hardware address is captured prior to the call to batadv_get_vid(), it points to memory that is freed once the skb is reallocated by pskb_may_pull().\nSubsequent attempts to access this hardware source address result in a use-after-free scenario, as the logic operates on dangling pointers. The kernel then attempts to read from or write to memory that has either been returned to the slab allocator or re-assigned to a different kernel object, leading to undefined behavior.\nThe attack flow follows these steps: 1) The attacker injects a malformed or specific ARP packet into the batman-adv mesh network. 2) The batman-adv subsystem intercepts the packet for DAT processing. 3) The kernel executes batadv_get_vid(), which invokes pskb_may_pull(), triggering a buffer reallocation and invalidating existing pointers to the ARP header. 4) The subsystem attempts to reference the previously captured hardware source address pointer. 5) The kernel accesses the stale memory, resulting in a use-after-free condition. 6) Depending on the state of the heap, this results in a kernel panic or potentially controlled memory corruption."
}