CVE-2026-80601

CVE-2026-80601 is a use-after-free in the batman-adv (B.A.T.M.A.N. Advanced) mesh networking module of the Linux kernel: in the gateway (gw) code, a pointer to the packet's Ethernet header is taken before batadv_get_vid() calls pskb_may_pull(), which can reallocate the buffer behind the socket buffer (skb) and leave the cached pointer dangling. An adjacent-network attacker (CVSS AV:A) can trigger this by sending crafted packets through a batman-adv interface such that the buffer is reallocated and the stale Ethernet-header pointer is then dereferenced and used. Successful exploitation yields high impact to confidentiality, integrity and availability per CVSS, typically a kernel crash/denial of service with potential for kernel-context code execution. Only systems that actually load and use batman-adv — chiefly community mesh networks and batman-adv-enabled routers or hosts — are affected; general-purpose Linux systems that never enable the module are not. No public proof-of-concept or known exploitation exists; EPSS estimates a 0.3% probability of exploitation within 30 days, and the flaw is not in CISA KEV.

What to do: Apply a kernel update containing this fix as soon as your distribution or firmware vendor ships it, and ensure the batman-adv module is rebuilt/loaded for the running kernel; mesh operators on Gluon/OpenWrt should watch for firmware updates that pull in the patched kernel. As an interim measure, limit untrusted adjacent access to batman-adv mesh interfaces, and on systems that do not use batman-adv, blacklist or unload the module. Verify by checking that the running kernel includes the 'batman-adv: gw: acquire ethernet header only after skb realloc' commit.