vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2026-80601

batman-adv: gw: acquire ethernet header only after skb realloc

HIGH
8.8
CVSS Score
Published: August 28, 2026 at 06:48 AM UTC
Updated: October 16, 2026 at 08:18 PM UTC
1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
HIGH8.8
Exploit prediction
EPSS 0.4%
SSVC
No known exploit

Description

In the Linux kernel, the following vulnerability has been resolved: batman-adv: gw: acquire ethernet header only after skb realloc The pskb_may_pull() called by batadv_get_vid() could reallocate the buffer behind the skb. Variables which were pointing to the old buffer need to be reassigned to avoid an use-after-free.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Linux Kernel· Linux
90%
3.146c413b1c22a2c4ef324f1c6f2c282f1ca10a93b9
Vendor states this is fixed in 2760b38222c8828b075802342fe3b91eb823d542 (fixed)
Vendor states this is fixed in 6c37f1166549c999ccd164b0cb6462d1ae68f8f6 (fixed)
Vendor states this is fixed in 77880a3be88d378d60cc1e8f8ec70430e2ed0518 (fixed)
Vendor states this is fixed in 916dac5f2944f63f07f7b501acbea6737dbbed0e (fixed)
Vendor states this is fixed in afac8096bde4948e3caa7e4dd733867cfbd3018e (fixed)
Vendor states this is fixed in b79884a5567bf788fb76c30832467cf6a56f3c0d (fixed)
Vendor states this is fixed in e3f4325e35dd6e76b80665f3510738ce34819753 (fixed)
Vendor states this is fixed in e6b43acd34b219b807e65096ce207b087942779d (fixed)
Vendor states this is fixed in 3.14 (unaffected)
Vendor states this is fixed in 5.10.261 (unaffected)
Vendor states this is fixed in 5.15.212 (unaffected)
Vendor states this is fixed in 6.1.178 (unaffected)
Vendor states this is fixed in 6.12.97 (unaffected)
Vendor states this is fixed in 6.18.40 (unaffected)
Vendor states this is fixed in 6.6.145 (unaffected)
Vendor states this is fixed in 7.1.5 (unaffected)
Vendor states this is fixed in 7.2 (unaffected)

Remediation

No guide yet

No remediation guidance has been written for this CVE yet, and no fixed version or vendor advisory is recorded against it.

References (8)

Source: cverecord
https://git.kernel.org/stable/c/2760b38222c8828b075802342fe3b91eb823d542
Source: cverecord
https://git.kernel.org/stable/c/6c37f1166549c999ccd164b0cb6462d1ae68f8f6
Source: cverecord
https://git.kernel.org/stable/c/b79884a5567bf788fb76c30832467cf6a56f3c0d
Source: cverecord
https://git.kernel.org/stable/c/afac8096bde4948e3caa7e4dd733867cfbd3018e
Source: cverecord
https://git.kernel.org/stable/c/e3f4325e35dd6e76b80665f3510738ce34819753
Source: cverecord
https://git.kernel.org/stable/c/e6b43acd34b219b807e65096ce207b087942779d
Source: cverecord
https://git.kernel.org/stable/c/916dac5f2944f63f07f7b501acbea6737dbbed0e
Source: cverecord
https://git.kernel.org/stable/c/77880a3be88d378d60cc1e8f8ec70430e2ed0518

SSVC — Action Prioritization

SSVCNo known exploitNot automatableTotal impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

8.8HIGHLinux
Vector?

Quick Info

StatusRECEIVED

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card