Description

In the Linux kernel, the following vulnerability has been resolved: batman-adv: gw: acquire ethernet header only after skb realloc The pskb_may_pull() called by batadv_get_vid() could reallocate the buffer behind the skb. Variables which were pointing to the old buffer need to be reassigned to avoid an use-after-free.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-28T08:16:43.947Z",
  "pubdate": "2026-08-28T08:16:43.947Z",
  "executiveSummary": "A use-after-free (UAF) vulnerability exists in the batman-adv kernel module due to improper handling of socket buffer (skb) pointers during memory reallocation.\nThe vulnerability occurs when pskb_may_pull() is invoked within batadv_get_vid(), potentially triggering a buffer reallocation that invalidates existing pointers to the ethernet header.\nAn attacker capable of injecting specifically crafted packets can trigger this memory corruption, leading to a system crash, kernel panic, or potentially arbitrary code execution.\nThe flaw affects the Linux kernel within the batman-adv subsystem, specifically impacting components handling gateway (gw) operations.\nExploitation requires the attacker to be in a position to influence the packet structure processed by the batman-adv protocol, typically within a local or reachable network segment.\nThe risk is critical as it involves memory safety violations in kernel-space, which can be leveraged for privilege escalation or denial-of-service.",
  "technicalDetails": "The vulnerability resides within the batman-adv gateway (gw) handling logic. Specifically, the function batadv_get_vid() performs an operation that calls pskb_may_pull().\nIn the Linux networking stack, pskb_may_pull() is used to ensure that a specified number of bytes of the protocol header are present in the linear data area of the sk_buff (skb). If the requested data resides in non-linear fragments, the function triggers a re-allocation of the skb's data buffer to pull the data into a contiguous linear region.\nThe root cause of this vulnerability is the premature acquisition of an ethernet header pointer before the call to pskb_may_pull(). When the underlying memory of the skb is reallocated, the original pointer remains associated with the address of the old, now-freed memory region.\nSubsequent access to this pointer constitutes a use-after-free (UAF) condition. Because the memory has been returned to the kernel's allocator, it may be reallocated to another process or kernel structure.\nThe attack flow proceeds as follows: 1) An attacker transmits a malformed packet designed to pass initial checks but require expansion via pskb_may_pull() during the execution of batadv_get_vid(). 2) The kernel executes batadv_get_vid(), which calculates the ethernet header address while the buffer is in its initial state. 3) The execution reaches pskb_may_pull(), which forces a linear buffer reallocation, invalidating the pointer previously captured by the calling function. 4) The kernel continues execution, attempting to dereference the stale pointer, leading to a memory safety violation.\nThe vulnerable component is the batman-adv subsystem, which is responsible for the B.A.T.M.A.N. routing protocol. By manipulating the size and content of network frames, an attacker can influence the kernel memory layout at the moment of reallocation.\nSuccessful exploitation allows for memory corruption, which is a potent primitive for local privilege escalation or the subversion of kernel control flow. Since this occurs within the interrupt or softirq context of the network stack, the impact is severe, potentially resulting in immediate system instability."
}