CVE-2026-80599

CVE-2026-80599 is an out-of-bounds access flaw in the Linux kernel's batman-adv mesh networking subsystem, where batadv_dat_get_vid() reads the protocol field of an Ethernet header without first verifying that the underlying header data is actually accessible. It is triggered over an adjacent network when packets reach the Distributed ARP Table (DAT) code path with an Ethernet header that spans insufficiently accessible data, causing the kernel to access memory beyond the packet buffer. Per the assigned CVSS score (8.1, AV:A/AC:L/PR:N/UI:N), an adjacent attacker with no privileges and no user interaction could potentially disclose kernel memory (high confidentiality impact) or crash the host (high availability impact). Only systems with the batman-adv module loaded and in use are affected, primarily mesh networking deployments such as community mesh networks and OpenWrt/Gluon-style router meshes, since the module is not enabled by default on most Linux systems. No exploitation in the wild, public proof-of-concept, or CISA KEV listing is known, and EPSS estimates only a 0.3% probability of exploitation within 30 days.

What to do: Patch affected hosts with a Linux kernel update that includes the batman-adv DAT fix referenced by this advisory; since specific fixed version numbers were not provided in the source data, apply your distribution's backport when it becomes available. As an interim mitigation, unload or disable the batman-adv module on systems not actively serving as mesh nodes and restrict adjacent-network access to batman-adv interfaces. Check exposure by confirming whether the module is loaded (e.g., 'lsmod | grep batman_adv') and whether any interfaces are bound to it.