CVE-2026-80599 (GCVE-0-2026-80599)
Vulnerability from cvelistv5
Published
2026-08-28 06:48
Modified
2026-08-29 06:21
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
batman-adv: dat: ensure accessible eth_hdr proto field
When batadv_get_vid() accesses the proto field of the ethernet header, it
is not checking if the data itself is accessible. The caller is responsible
for it. But in contrast to other call sites, batadv_dat_get_vid() and its
caller didn't make sure this is true. This could have caused an
out-of-bounds access.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: be1db4f6615b5e6156c807ea8985171c215c2d57 Version: be1db4f6615b5e6156c807ea8985171c215c2d57 Version: be1db4f6615b5e6156c807ea8985171c215c2d57 Version: be1db4f6615b5e6156c807ea8985171c215c2d57 Version: be1db4f6615b5e6156c807ea8985171c215c2d57 Version: be1db4f6615b5e6156c807ea8985171c215c2d57 Version: be1db4f6615b5e6156c807ea8985171c215c2d57 Version: be1db4f6615b5e6156c807ea8985171c215c2d57 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/batman-adv/distributed-arp-table.c",
"net/batman-adv/main.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "da3677b5ed362742d30ceab31bfafcdc74dc2642",
"status": "affected",
"version": "be1db4f6615b5e6156c807ea8985171c215c2d57",
"versionType": "git"
},
{
"lessThan": "6d3ea37074bb747f745d28138f87745ba9bd97c5",
"status": "affected",
"version": "be1db4f6615b5e6156c807ea8985171c215c2d57",
"versionType": "git"
},
{
"lessThan": "7913935d41f166c367bbf7cc76a79e50044388e8",
"status": "affected",
"version": "be1db4f6615b5e6156c807ea8985171c215c2d57",
"versionType": "git"
},
{
"lessThan": "3c62694c31f043568c3f4784b8d247cc3bea6b4c",
"status": "affected",
"version": "be1db4f6615b5e6156c807ea8985171c215c2d57",
"versionType": "git"
},
{
"lessThan": "5836a050d02e9598fa0f71e88dde28b63dfa35e3",
"status": "affected",
"version": "be1db4f6615b5e6156c807ea8985171c215c2d57",
"versionType": "git"
},
{
"lessThan": "8f76277d02176cd739945bba3379448e2e22e799",
"status": "affected",
"version": "be1db4f6615b5e6156c807ea8985171c215c2d57",
"versionType": "git"
},
{
"lessThan": "4407ff3af469356f9641c4a6e7072309bae86bea",
"status": "affected",
"version": "be1db4f6615b5e6156c807ea8985171c215c2d57",
"versionType": "git"
},
{
"lessThan": "26560c4a03dc4d607331600c187f59ab2df5f341",
"status": "affected",
"version": "be1db4f6615b5e6156c807ea8985171c215c2d57",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/batman-adv/distributed-arp-table.c",
"net/batman-adv/main.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.13"
},
{
"lessThan": "3.13",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "3.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "3.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "3.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "3.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "3.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "3.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "3.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "3.13",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbatman-adv: dat: ensure accessible eth_hdr proto field\n\nWhen batadv_get_vid() accesses the proto field of the ethernet header, it\nis not checking if the data itself is accessible. The caller is responsible\nfor it. But in contrast to other call sites, batadv_dat_get_vid() and its\ncaller didn\u0027t make sure this is true. This could have caused an\nout-of-bounds access."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:A - Exploitation requires injecting crafted ETH_P_BATMAN frames on the victim\u0027s batman-adv hard interface via batadv_batman_skb_recv(); an attacker must be on the same L2 mesh segment (WiFi community mesh, industrial mesh, or shared Ethernet backbone), not arbitrary Internet routing.\nAC:L - The attacker fully controls remote packet length and contents; sending a batman-adv unicast or broadcast frame with only the batman header (10 or 14 bytes) and no embedded Ethernet payload bypasses hdr_size-only pskb_may_pull checks and deterministically forces the h_proto read past skb-\u003etail without races or rare configuration.\nPR:N - No Linux account or capability on the victim is required; any unauthenticated mesh peer that can transmit ETH_P_BATMAN frames to an active batman-adv node with Distributed ARP Table enabled reaches batadv_dat_snoop_incoming_*() through the normal RX handler without local login or CAP_NET_ADMIN on the target.\nUI:N - The vulnerable path runs automatically in softirq when the mesh interface receives qualifying traffic; no victim mount, click, or administrative action is needed beyond batman-adv already running with DAT enabled (the default at mesh interface creation).\nS:U - Impact is an out-of-bounds kernel read during batman-adv packet processing on the receiving mesh node; it does not cross a VM, container, or IOMMU security boundary to affect a different authority\u0027s resources.\nC:H - batadv_get_vid() reads ethhdr-\u003eh_proto (2 bytes at offset 12 within the embedded Ethernet header) without ensuring hdr_size+ETH_HLEN bytes are accessible, causing an out-of-bounds read of adjacent skb tailroom or slab memory beyond the packet buffer per kernel OOB-read guidance.\nI:N - This is an out-of-bounds read only with no memory write or corruption; subsequent batadv_arp_get_type() performs its own pskb_may_pull() before further parsing, and the DAT snoop path returns without modifying kernel structures beyond the illicit read.\nA:H - Reading past skb-\u003etail in NET_RX_SOFTIRQ can provoke a kernel oops or panic when the access crosses an unmapped page boundary, denying mesh and host connectivity; any out-of-bounds kernel access on the packet receive path is rated high availability impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-29T06:21:11.082Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/da3677b5ed362742d30ceab31bfafcdc74dc2642"
},
{
"url": "https://git.kernel.org/stable/c/6d3ea37074bb747f745d28138f87745ba9bd97c5"
},
{
"url": "https://git.kernel.org/stable/c/7913935d41f166c367bbf7cc76a79e50044388e8"
},
{
"url": "https://git.kernel.org/stable/c/3c62694c31f043568c3f4784b8d247cc3bea6b4c"
},
{
"url": "https://git.kernel.org/stable/c/5836a050d02e9598fa0f71e88dde28b63dfa35e3"
},
{
"url": "https://git.kernel.org/stable/c/8f76277d02176cd739945bba3379448e2e22e799"
},
{
"url": "https://git.kernel.org/stable/c/4407ff3af469356f9641c4a6e7072309bae86bea"
},
{
"url": "https://git.kernel.org/stable/c/26560c4a03dc4d607331600c187f59ab2df5f341"
}
],
"title": "batman-adv: dat: ensure accessible eth_hdr proto field",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80599",
"datePublished": "2026-08-28T06:48:26.709Z",
"dateReserved": "2026-08-26T14:34:25.771Z",
"dateUpdated": "2026-08-29T06:21:11.082Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…