CVE-2026-80600: Linux Kernel batman-adv Use-After-Free

CVE-2026-80600 Overview

CVE-2026-80600 is a use-after-free vulnerability in the Linux kernel's batman-adv (B.A.T.M.A.N. Advanced) mesh networking module. The flaw resides in the Distributed ARP Table (DAT) subsystem, specifically in the code path that processes ARP hardware source addresses. When batadv_get_vid() invokes pskb_may_pull(), the socket buffer (skb) may be reallocated. Pointers referencing the previous buffer become stale, and subsequent dereferences access freed memory. The fix reassigns the ARP hardware source pointer only after the potential skb reallocation completes.

Critical Impact
Network-adjacent attackers can trigger use-after-free conditions in kernel memory by transmitting crafted ARP frames over batman-adv mesh interfaces, potentially leading to kernel memory corruption, denial of service, or code execution.

Affected Products

Linux kernel with batman-adv module compiled and loaded
Distributions using mesh networking based on B.A.T.M.A.N. Advanced
Multiple stable kernel branches (see kernel.org commits for backport ranges)

Discovery Timeline

2026-08-28 - CVE-2026-80600 published to NVD
2026-08-29 - Last updated in NVD database

Technical Details for CVE-2026-80600

Vulnerability Analysis

The vulnerability affects the batman-adv DAT (Distributed ARP Table) processing path. Before the fix, the handler acquired a pointer to the ARP hardware source address inside the skb payload, then called batadv_get_vid(). That helper invokes pskb_may_pull(), which can reallocate the underlying buffer when the packet requires linearization or additional headroom. After reallocation, the previously cached pointer references freed memory. Any read or write through that pointer constitutes a use-after-free [CWE-416] against kernel heap memory.

Because the affected code runs inside softirq context on received frames, an attacker on the same mesh segment can influence the trigger conditions by crafting ARP payloads that force reallocation. Kernel use-after-free issues in network receive paths are a well-established class of remote memory-corruption primitives.

Root Cause

The root cause is unsafe pointer caching across a call that may reallocate the socket buffer. The pskb_may_pull() contract explicitly warns callers that pointers into the skb linear data must be re-derived after the call succeeds. The pre-patch code violated this contract by holding the ARP hw_src pointer across the call, producing a dangling reference.

Attack Vector

Exploitation requires the target system to run batman-adv and participate in a mesh network reachable by the attacker. A remote unauthenticated attacker sends specially crafted ARP frames tuned to force pskb_may_pull() to reallocate the buffer. Subsequent use of the stale pointer corrupts kernel memory. Impact ranges from a kernel panic (denial of service) to potential privilege escalation or code execution when the freed slab region is reoccupied with attacker-influenced data.

No public proof-of-concept exploit is currently listed, and the vulnerability is not in the CISA KEV catalog. Verified code details are available in the upstream commits referenced below.

Detection Methods for CVE-2026-80600

Indicators of Compromise

Unexpected kernel oops or panic entries in dmesg referencing batadv_* functions or batadv_dat_snoop_* symbols.
KASAN reports flagging use-after-free reads in batman-adv receive paths on kernels built with CONFIG_KASAN=y.
Sudden loss of connectivity or module crashes on nodes participating in batman-adv mesh networks.

Detection Strategies

Inventory Linux hosts with the batman-adv module loaded using lsmod | grep batman_adv and correlate against installed kernel versions.
Monitor kernel logs for oops signatures pointing to net/batman-adv/distributed-arp-table.c frames.
On test systems, enable KASAN and replay suspicious traffic captured from mesh interfaces to surface use-after-free traces.

Monitoring Recommendations

Forward /var/log/kern.log and journald kernel entries to a centralized log platform and alert on batadv_ crash signatures.
Track running kernel versions across the fleet and compare against the fixed versions listed in the referenced stable commits.
Alert on interface flaps or module unload events for bat0 and related mesh interfaces.

How to Mitigate CVE-2026-80600

Immediate Actions Required

Update the Linux kernel to a version that includes the upstream fix on all systems running batman-adv.
If patching cannot occur immediately, unload the module with modprobe -r batman_adv on hosts that do not require mesh networking.
Restrict physical and layer-2 access to mesh network segments to trusted devices only.

Patch Information

The fix is delivered through multiple stable-tree backports. The change reassigns the ARP hardware source pointer after batadv_get_vid() returns, ensuring the pointer references the current skb buffer. Apply the vendor kernel update that incorporates one of the following commits:

Workarounds

Blacklist the batman-adv kernel module on systems that do not require it by adding blacklist batman-adv to /etc/modprobe.d/.
Disable Distributed ARP Table functionality on mesh nodes using batctl dat_mode disable where operational requirements allow.
Segment mesh networks from untrusted devices using MAC filtering and physical isolation until patched kernels are deployed.

bash

# Verify kernel version and batman-adv module status
uname -r
lsmod | grep batman_adv

# Disable the module if mesh networking is not required
echo "blacklist batman-adv" | sudo tee /etc/modprobe.d/disable-batman-adv.conf
sudo modprobe -r batman_adv

# Optional: disable DAT on mesh nodes still in production
sudo batctl dat_mode disable