CVE-2026-80600

A use-after-free flaw exists in the Linux kernel's batman-adv mesh networking module, in the distributed ARP table (DAT) code. When processing a packet, the batadv_get_vid() helper calls pskb_may_pull(), which can reallocate the buffer behind the socket buffer (skb); pointers previously taken into that buffer, such as the ARP hardware-source field, are not refreshed, so subsequent access reads freed memory. A network-adjacent attacker who can inject crafted packets into a batman-adv mesh link can therefore trigger kernel memory corruption, potentially causing a crash (denial of service) or, per the 9.8 CVSS score, high-impact confidentiality, integrity and availability loss. Any system running a kernel with the batman-adv module loaded and a configured mesh interface is affected, which is typical of OpenWrt/Gluon-based community mesh routers and Linux mesh gateways; the data does not specify affected or fixed version ranges. Exploitation has not been observed: there is no public proof-of-concept, the flaw is not in CISA KEV, and EPSS estimates only a 0.5% chance of exploitation in the next 30 days.

What to do: Track your Linux/OpenWrt distribution for a kernel update containing the upstream batman-adv DAT fix and apply it as soon as it is available (specific fixed version numbers were not provided in the source data). In the meantime, check whether the module is in use (e.g., 'lsmod | grep batman_adv' and configured batadv/mesh interfaces); if batman-adv is not actively used, disable or unload it. Limit exposure by restricting which devices can inject layer-2 traffic into mesh segments until systems are patched.