CVE-2026-72231 (GCVE-0-2026-72231)
Vulnerability from cvelistv5
Published
2026-08-15 05:54
Modified
2026-08-17 05:41
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
batman-adv: tt: avoid request storms during pending request
batadv_send_tt_request() allocates a tt_req_node when none exists for the
destination originator node. This should prevent that a multiple TT
requests are send at the same time to an originator.
But if allocation of the send buffer failed, this request must be cleaned
up again. But indicator for such a failure is "ret == false". But the
actual implementation is checking for "ret == true".
The check must be inverted to not loose the information about the TT
request directly after it was attempted to be sent out. This should avoid
potential request storms.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 335fbe0f5d2501b7dd815806aef6fd9bad784eb1 Version: 335fbe0f5d2501b7dd815806aef6fd9bad784eb1 Version: 335fbe0f5d2501b7dd815806aef6fd9bad784eb1 Version: 335fbe0f5d2501b7dd815806aef6fd9bad784eb1 Version: 335fbe0f5d2501b7dd815806aef6fd9bad784eb1 Version: 335fbe0f5d2501b7dd815806aef6fd9bad784eb1 Version: 335fbe0f5d2501b7dd815806aef6fd9bad784eb1 Version: 335fbe0f5d2501b7dd815806aef6fd9bad784eb1 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/batman-adv/translation-table.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "6055695ea40c64a47e00742c12c99b1a33b4daed",
"status": "affected",
"version": "335fbe0f5d2501b7dd815806aef6fd9bad784eb1",
"versionType": "git"
},
{
"lessThan": "21c44a6895f41df811d1c91d10eea194dda2b345",
"status": "affected",
"version": "335fbe0f5d2501b7dd815806aef6fd9bad784eb1",
"versionType": "git"
},
{
"lessThan": "5e46c76d9a5062212c4c5f642a5549fd9c057f8a",
"status": "affected",
"version": "335fbe0f5d2501b7dd815806aef6fd9bad784eb1",
"versionType": "git"
},
{
"lessThan": "067e413eec2e63c2996909ef55214b3a0eda0be7",
"status": "affected",
"version": "335fbe0f5d2501b7dd815806aef6fd9bad784eb1",
"versionType": "git"
},
{
"lessThan": "716f434eb35869e130424331584a91fbb729b9bd",
"status": "affected",
"version": "335fbe0f5d2501b7dd815806aef6fd9bad784eb1",
"versionType": "git"
},
{
"lessThan": "6a65ac8a81e903bb4b555c1d13532f5cb0167a4a",
"status": "affected",
"version": "335fbe0f5d2501b7dd815806aef6fd9bad784eb1",
"versionType": "git"
},
{
"lessThan": "aba1cf21954e64c36afb966b754adad2b0b8aa48",
"status": "affected",
"version": "335fbe0f5d2501b7dd815806aef6fd9bad784eb1",
"versionType": "git"
},
{
"lessThan": "27c7d40008231ae4140d35501b60087a9de2d2c3",
"status": "affected",
"version": "335fbe0f5d2501b7dd815806aef6fd9bad784eb1",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/batman-adv/translation-table.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.13"
},
{
"lessThan": "3.13",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "3.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "3.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "3.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "3.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "3.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "3.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "3.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "3.13",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbatman-adv: tt: avoid request storms during pending request\n\nbatadv_send_tt_request() allocates a tt_req_node when none exists for the\ndestination originator node. This should prevent that a multiple TT\nrequests are send at the same time to an originator.\n\nBut if allocation of the send buffer failed, this request must be cleaned\nup again. But indicator for such a failure is \"ret == false\". But the\nactual implementation is checking for \"ret == true\".\n\nThe check must be inverted to not loose the information about the TT\nrequest directly after it was attempted to be sent out. This should avoid\npotential request storms."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The bug is reached when remote batman-adv OGM/TVLV packets are received on an active mesh hardif via batadv_batman_skb_recv() \u2192 batadv_iv_ogm_recv() \u2192 batadv_tvlv_ogm_receive() \u2192 batadv_tt_update_orig() \u2192 batadv_send_tt_request(), with no local syscall required on the victim.\nAC:L - A mesh attacker can deterministically craft OGMs with mismatched TTVN/CRC to force the request_table path on every received OGM; the inverted ret check removes the pending tt_req_node after each successful send, eliminating deduplication so storms are repeatable without races.\nPR:N - batman-adv OGM/TVLV processing performs no authentication or capability check on senders; any mesh peer that can inject ETH_P_BATMAN frames onto the victim\u0027s active hardif triggers the vulnerable path without Linux credentials on the victim host.\nUI:N - No victim user action is required once batman-adv is active; the kernel automatically processes incoming OGMs and issues TT_REQUEST unicasts in response to detected translation-table inconsistency, entirely driven by attacker-supplied mesh traffic.\nS:U - Impact is confined to excessive batman-adv translation-table control traffic and resource exhaustion on the victim mesh node within the kernel networking stack; it does not cross VM, container, IOMMU, or other security authority boundaries.\nC:N - The inverted conditional is a pure logic error in tt_req_node list housekeeping; it causes neither out-of-bounds access, use-after-free, nor uninitialized data transmission, so no information-disclosure or memory-read primitive exists.\nI:N - No attacker-controlled kernel memory writes or data corruption occur; the bug only suppresses pending-request tracking so duplicate TT_REQUEST packets are emitted, flooding mesh bandwidth without modifying stored translation-table contents.\nA:H - Removing the tt_req_node immediately after each successful TT_REQUEST disables the one-request-per-originator guard, letting a remote attacker drive unbounded GFP_ATOMIC allocations and mesh-wide TT_REQUEST storms that can exhaust CPU, memory, and link capacity on community mesh nodes."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T05:41:48.586Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/6055695ea40c64a47e00742c12c99b1a33b4daed"
},
{
"url": "https://git.kernel.org/stable/c/21c44a6895f41df811d1c91d10eea194dda2b345"
},
{
"url": "https://git.kernel.org/stable/c/5e46c76d9a5062212c4c5f642a5549fd9c057f8a"
},
{
"url": "https://git.kernel.org/stable/c/067e413eec2e63c2996909ef55214b3a0eda0be7"
},
{
"url": "https://git.kernel.org/stable/c/716f434eb35869e130424331584a91fbb729b9bd"
},
{
"url": "https://git.kernel.org/stable/c/6a65ac8a81e903bb4b555c1d13532f5cb0167a4a"
},
{
"url": "https://git.kernel.org/stable/c/aba1cf21954e64c36afb966b754adad2b0b8aa48"
},
{
"url": "https://git.kernel.org/stable/c/27c7d40008231ae4140d35501b60087a9de2d2c3"
}
],
"title": "batman-adv: tt: avoid request storms during pending request",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-72231",
"datePublished": "2026-08-15T05:54:22.076Z",
"dateReserved": "2026-08-09T03:40:39.913Z",
"dateUpdated": "2026-08-17T05:41:48.586Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…