CVE-2026-80601: Linux Kernel Use-After-Free Vulnerability

CVE-2026-80601 Overview

CVE-2026-80601 is a use-after-free vulnerability in the Linux kernel's batman-adv (B.A.T.M.A.N. Advanced) mesh networking module. The flaw resides in the gateway client code path, where batadv_get_vid() invokes pskb_may_pull(), which can reallocate the socket buffer (skb) backing memory. Variables that pointed into the previous buffer, including the Ethernet header pointer, remained referenced after reallocation, producing a use-after-free condition on adjacent-network traffic.

Critical Impact
An attacker on the same layer-2 mesh network can trigger memory corruption in the kernel by sending crafted frames, potentially leading to code execution, privilege escalation, or denial of service.

Affected Products

Linux kernel builds compiled with the batman-adv module (CONFIG_BATMAN_ADV)
Systems participating in B.A.T.M.A.N. Advanced mesh networks (routers, embedded devices, OpenWrt-based platforms)
Multiple upstream stable branches prior to the fixes referenced by commits 2760b38, 6c37f11, 77880a3, 916dac5, afac809, b79884a, e3f4325, and e6b43ac

Discovery Timeline

2026-08-28 - CVE-2026-80601 published to NVD
2026-08-29 - Last updated in NVD database

Technical Details for CVE-2026-80601

Vulnerability Analysis

The defect lives in the batman-adv gateway (gw) client handling code. When a frame enters the gateway processing path, the code first obtains a pointer to the Ethernet header via eth_hdr(skb) and then calls batadv_get_vid() to extract the VLAN identifier. Internally, batadv_get_vid() invokes pskb_may_pull() to ensure enough linear header data is available.

pskb_may_pull() may reallocate the skb's data buffer when the current headroom is insufficient. After reallocation, any pointer that referenced the old buffer, including the previously fetched Ethernet header, becomes dangling. Subsequent reads or writes through that stale pointer constitute a use-after-free [CWE-416].

Root Cause

The root cause is a lifetime assumption violation. The gateway code cached a pointer into skb->data before calling a function that may relocate skb->data. The upstream fix reorders operations so the Ethernet header is dereferenced only after the potential reallocation completes, ensuring the pointer references the current, valid buffer.

Attack Vector

The CVSS vector indicates adjacent-network reachability with no privileges or user interaction required. An attacker must be able to inject frames onto a batman-adv mesh segment that reaches a vulnerable node. Crafted frames that force pskb_may_pull() to reallocate the linear buffer trigger the stale-pointer dereference during gateway client processing.

No verified public exploit is available for CVE-2026-80601. Technical details are documented in the upstream kernel commits referenced in the External References section.

Detection Methods for CVE-2026-80601

Indicators of Compromise

Kernel oops or panic messages referencing batadv_gw_out_of_range, batadv_get_vid, or pskb_may_pull in dmesg and /var/log/kern.log
KASAN reports flagging use-after-free reads on skb linear data within the batman-adv module
Unexpected reboots or crashes on mesh nodes correlated with anomalous batman-adv traffic patterns

Detection Strategies

Inventory Linux hosts loading the batman_adv kernel module using lsmod | grep batman_adv and compare running kernel versions against fixed commits.
Enable KASAN on non-production kernels during batman-adv regression testing to surface the stale-pointer dereference.
Correlate mesh interface traffic spikes with kernel crash telemetry to identify probe attempts.

Monitoring Recommendations

Forward kernel.* syslog facility events to a central log platform and alert on batman_adv stack traces.
Monitor availability of mesh gateway nodes; recurring unexplained reboots warrant investigation.
Track kernel package versions across fleet inventory to confirm remediation coverage over time.

How to Mitigate CVE-2026-80601

Immediate Actions Required

Upgrade to a Linux kernel release that includes one of the fixing commits: 2760b38, 6c37f11, 77880a3, 916dac5, afac809, b79884a, e3f4325, or e6b43ac.
On distributions that ship batman-adv as an out-of-tree module, apply vendor updates as soon as they are published.
Restrict physical and logical access to mesh segments so untrusted devices cannot inject frames into batman-adv networks.

Patch Information

The upstream fix reorders the gateway client code to acquire the Ethernet header pointer only after batadv_get_vid() returns, ensuring the pointer references the post-reallocation buffer. The change is distributed across the following kernel commits: Kernel Git Commit 2760b38, Kernel Git Commit 6c37f11, Kernel Git Commit 77880a3, Kernel Git Commit 916dac5, Kernel Git Commit afac809, Kernel Git Commit b79884a, Kernel Git Commit e3f4325, and Kernel Git Commit e6b43ac.

Workarounds

Unload the batman_adv module on hosts that do not require mesh networking: modprobe -r batman_adv and blacklist it in /etc/modprobe.d/.
Isolate mesh interfaces from untrusted clients using MAC filtering, 802.1X, or physical segmentation until patches are deployed.
Disable the batman-adv gateway client role on nodes that do not need it, reducing exposure of the affected code path.

bash

# Configuration example: disable batman-adv where not required
echo 'blacklist batman_adv' | sudo tee /etc/modprobe.d/disable-batman-adv.conf
sudo modprobe -r batman_adv

# Verify the module is not loaded
lsmod | grep batman_adv || echo 'batman_adv not loaded'