Executive brief
The batman-adv module in the Linux kernel is a mesh networking implementation that handles ARP (Address Resolution Protocol) for distributed networks. A use-after-free vulnerability exists in its DHCP ACK snooping functionality, where buffer reallocation during packet processing can cause the code to reference freed memory, potentially leading to system crash or arbitrary code execution.
Technical details
The vulnerability is a use-after-free flaw in the batadv_dat_snoop_incoming_dhcp_ack() function within net/batman-adv/distributed-arp-table.c. The root cause is that pskb_may_pull() called by batadv_get_vid() may reallocate the socket buffer (skb), invalidating previously saved pointers. The code was storing a pointer (ethhdr) before calling batadv_get_vid(), which could reallocate the buffer, causing the ethhdr pointer to reference freed memory. The fix reorders operations to call batadv_get_vid() first (with a temporary hdr_size copy), then safely acquire the ethhdr pointer from the reallocated buffer. The vulnerability affects the distributed ARP table (DAT) module and can be triggered by processing specially crafted DHCP ACK packets on systems running affected kernel versions.
Affected products
- Linux Linux kernel Multiple versions from 2.6.11 through at least 6.9 and later (batman-adv module)
Timeline
- 2026-08-28: disclosed: CVE-2026-80600 published
- 2026-06-28: patched: Patch authored by Sven Eckelmann
- 2026-07-24: patched: Patch committed to stable kernel trees by Greg Kroah-Hartman