CVE-2026-80599: Linux Kernel batman-adv Buffer Overflow

CVE-2026-80599 Overview

CVE-2026-80599 is an out-of-bounds read vulnerability in the Linux kernel's batman-adv (Better Approach To Mobile Ad-hoc Networking) module. The flaw resides in batadv_dat_get_vid(), which invokes batadv_get_vid() to access the proto field of an Ethernet header without validating that the underlying data is accessible. Callers of batadv_get_vid() are responsible for ensuring buffer accessibility, but batadv_dat_get_vid() failed to enforce this contract. An attacker on an adjacent network can trigger the out-of-bounds access via crafted batman-adv traffic.

Critical Impact
Adjacent-network attackers can trigger kernel out-of-bounds reads leading to information disclosure or kernel panic on Linux systems using the batman-adv mesh networking module.

Affected Products

Linux kernel — net/batman-adv subsystem (Distributed ARP Table code)
Linux distributions shipping vulnerable stable kernels with batman-adv enabled
Mesh networking devices and OpenWrt-based systems relying on B.A.T.M.A.N. Advanced

Discovery Timeline

2026-08-28 - CVE-2026-80599 published to NVD
2026-08-29 - Last updated in NVD database

Technical Details for CVE-2026-80599

Vulnerability Analysis

The batman-adv module implements a Layer 2 mesh routing protocol in the Linux kernel. Its Distributed ARP Table (DAT) component uses batadv_dat_get_vid() to determine a frame's VLAN identifier by inspecting the Ethernet header. This helper calls batadv_get_vid(), which dereferences the proto field of struct ethhdr directly from the socket buffer (skb) data pointer.

batadv_get_vid() documents that callers must guarantee that the Ethernet header bytes are linear and accessible in the skb. Other call sites in the batman-adv code perform pskb_may_pull() or equivalent length checks before invoking the helper. The batadv_dat_get_vid() path did not perform this check, so a malformed or short frame could cause the kernel to read past the end of the linear skb buffer.

Root Cause

The root cause is a missing length validation before accessing header data in a network buffer, categorized as an out-of-bounds read [CWE-125]. batadv_dat_get_vid() violated the calling contract of batadv_get_vid() by not calling pskb_may_pull(skb, sizeof(struct ethhdr)) prior to dereferencing header fields. When batman-adv DAT processes an undersized or non-linear frame, the kernel reads unmapped or unrelated memory adjacent to the skb data region.

Attack Vector

Exploitation requires network adjacency: an attacker must be able to inject frames into a batman-adv mesh interface. Because batman-adv operates at Layer 2, no authentication is required to send traffic into the DAT processing path. Crafted ARP or Ethernet frames with truncated headers can reach batadv_dat_get_vid() and trigger the out-of-bounds read. Impact ranges from kernel information disclosure to a kernel crash and denial of service on the affected node, depending on adjacent memory layout and hardened usercopy or KASAN configuration.

The vulnerability manifests in the batman-adv DAT header parsing routine. See the upstream commits referenced below for the exact code paths and patch semantics.

Detection Methods for CVE-2026-80599

Indicators of Compromise

Kernel oops or panic logs referencing batadv_dat_get_vid, batadv_get_vid, or batadv_dat_snoop_incoming_arp_request in the stack trace.
KASAN reports flagging slab-out-of-bounds or use-after-free reads on skb->data inside batman-adv functions.
Unusual bursts of malformed or short ARP frames arriving on interfaces enrolled in a batman-adv mesh.

Detection Strategies

Enable CONFIG_KASAN on test kernels to surface out-of-bounds access when replaying suspected traffic against batman-adv nodes.
Monitor dmesg and journald for warnings from the batman_adv module and correlate with interface counters showing high rates of runt or malformed frames.
Inventory running kernels and identify hosts loading the batman_adv module via lsmod where the running version predates the fix commits (26560c4, 3c62694, 4407ff3, 5836a05, 6d3ea37, 7913935, 8f76277, da3677b).

Monitoring Recommendations

Alert on repeated kernel warnings or panics originating from mesh nodes, especially in OpenWrt or embedded fleets.
Track packet capture samples on mesh interfaces for ARP frames with Ethernet header lengths below sizeof(struct ethhdr).
Feed kernel telemetry from mesh devices into a central log platform to identify cluster-wide exploitation attempts.

How to Mitigate CVE-2026-80599

Immediate Actions Required

Upgrade to a Linux kernel release that includes one of the fix commits referenced by the Linux kernel stable tree.
On systems that do not require mesh networking, unload and blacklist the batman_adv module using modprobe -r batman_adv and a /etc/modprobe.d/ blacklist entry.
Restrict Layer 2 access to mesh interfaces by isolating trusted physical media and disabling batman-adv on untrusted radios.

Patch Information

The fix adds a pskb_may_pull() check in batadv_dat_get_vid() to ensure the Ethernet header is linear and accessible before invoking batadv_get_vid(). Refer to the upstream commits: 26560c4, 3c62694, 4407ff3, 5836a05, 6d3ea37, 7913935, 8f76277, and da3677b. Apply the vendor kernel update supplied by your distribution.

Workarounds

Disable the Distributed ARP Table feature on batman-adv interfaces with batctl dat 0 where supported.
Blacklist the batman_adv kernel module on hosts that do not require mesh routing.
Segment mesh radios and physical interfaces from untrusted clients until patched kernels are deployed.

bash

# Disable and blacklist the batman-adv module until patched
sudo modprobe -r batman_adv
echo 'blacklist batman_adv' | sudo tee /etc/modprobe.d/blacklist-batman-adv.conf

# Optional: disable DAT on an existing mesh interface
sudo batctl meshif bat0 dat 0