CVE-2026-52922

batman-adv: dat: handle forward allocation error

HIGH
7.5
CVSS Score
Published: June 24, 2026 at 07:14 AM UTC
Updated: August 5, 2026 at 01:24 PM UTC
1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Severity
HIGH7.5
Exploit prediction
EPSS 0.4%

Description

In the Linux kernel, the following vulnerability has been resolved: batman-adv: dat: handle forward allocation error batadv_dat_forward_data() calls pskb_copy_for_clone() to duplicate an skb for each DHT candidate, but does not check the return value before passing it to batadv_send_skb_prepare_unicast_4addr(). That function dereferences the skb unconditionally, so a failed allocation triggers a NULL pointer dereference. Skip forwarding to the current DHT candidate on allocation failure.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

3.8 ≤ v < 5.10.2583.8 ≤ v < 5.15.2093.8 ≤ v < 6.1.1753.8 ≤ v < 6.12.923.8 ≤ v < 6.18.343.8 ≤ v < 6.6.1423.8 ≤ v < 7.0.113.8 ≤ v < 7.15.11 ≤ v < 5.15.2095.16 ≤ v < 6.1.1756.13 ≤ v < 6.18.346.19 ≤ v < 7.0.116.2 ≤ v < 6.6.1426.7 ≤ v < 6.12.927.1 rc17.1 rc27.1 rc37.1 rc4785ea1144182c341b8b85b0f8180291839d176a8
Vendor states this is fixed in 2d8826a2d3657cea66fb0370f9e521575a673871 (fixed)
Vendor states this is fixed in 2edb8aeb3cdda9d00ec4997252dc5bcd6f54d8ef (fixed)
Vendor states this is fixed in 4d420d9ee70a220a2cd95aa0dd2e15acad66a505 (fixed)
Vendor states this is fixed in 866ac1d57040ed0b44ca732e3c66b3aa6b93011c (fixed)
Vendor states this is fixed in 9bcebaedfb8479cb4affb23c7a0d000ca9a20e73 (fixed)
Vendor states this is fixed in 9cceea8eeba710def2a5707ee00f00c74a9a1cac (fixed)
Vendor states this is fixed in ce0c381199402a2c58f4599f4f6ed100d872d0da (fixed)
Vendor states this is fixed in cf48e75fc4fe0d5cc7721c82d454221d01367b93 (fixed)
Vendor states this is fixed in 3.8 (unaffected)
Vendor states this is fixed in 5.10.258 (unaffected)
Vendor states this is fixed in 5.15.209 (unaffected)
Vendor states this is fixed in 6.1.175 (unaffected)
Vendor states this is fixed in 6.12.92 (unaffected)
Vendor states this is fixed in 6.18.34 (unaffected)
Vendor states this is fixed in 6.6.142 (unaffected)
Vendor states this is fixed in 7.0.11 (unaffected)
Vendor states this is fixed in 7.1 (unaffected)

CVSS

7.5HIGHLinux
Vector?

Quick Info

StatusANALYZED
CWE
CWE-476

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Free plan, no card