{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-72231", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-09T03:40:39.913Z", "datePublished": "2026-08-15T05:54:22.076Z", "dateUpdated": "2026-08-17T05:41:48.586Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-17T05:41:48.586Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbatman-adv: tt: avoid request storms during pending request\n\nbatadv_send_tt_request() allocates a tt_req_node when none exists for the\ndestination originator node. This should prevent that a multiple TT\nrequests are send at the same time to an originator.\n\nBut if allocation of the send buffer failed, this request must be cleaned\nup again. But indicator for such a failure is \"ret == false\". But the\nactual implementation is checking for \"ret == true\".\n\nThe check must be inverted to not loose the information about the TT\nrequest directly after it was attempted to be sent out. This should avoid\npotential request storms."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:N - The bug is reached when remote batman-adv OGM/TVLV packets are received on an active mesh hardif via batadv_batman_skb_recv() \u2192 batadv_iv_ogm_recv() \u2192 batadv_tvlv_ogm_receive() \u2192 batadv_tt_update_orig() \u2192 batadv_send_tt_request(), with no local syscall required on the victim.\nAC:L - A mesh attacker can deterministically craft OGMs with mismatched TTVN/CRC to force the request_table path on every received OGM; the inverted ret check removes the pending tt_req_node after each successful send, eliminating deduplication so storms are repeatable without races.\nPR:N - batman-adv OGM/TVLV processing performs no authentication or capability check on senders; any mesh peer that can inject ETH_P_BATMAN frames onto the victim's active hardif triggers the vulnerable path without Linux credentials on the victim host.\nUI:N - No victim user action is required once batman-adv is active; the kernel automatically processes incoming OGMs and issues TT_REQUEST unicasts in response to detected translation-table inconsistency, entirely driven by attacker-supplied mesh traffic.\nS:U - Impact is confined to excessive batman-adv translation-table control traffic and resource exhaustion on the victim mesh node within the kernel networking stack; it does not cross VM, container, IOMMU, or other security authority boundaries.\nC:N - The inverted conditional is a pure logic error in tt_req_node list housekeeping; it causes neither out-of-bounds access, use-after-free, nor uninitialized data transmission, so no information-disclosure or memory-read primitive exists.\nI:N - No attacker-controlled kernel memory writes or data corruption occur; the bug only suppresses pending-request tracking so duplicate TT_REQUEST packets are emitted, flooding mesh bandwidth without modifying stored translation-table contents.\nA:H - Removing the tt_req_node immediately after each successful TT_REQUEST disables the one-request-per-originator guard, letting a remote attacker drive unbounded GFP_ATOMIC allocations and mesh-wide TT_REQUEST storms that can exhaust CPU, memory, and link capacity on community mesh nodes."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/batman-adv/translation-table.c"], "versions": [{"version": "335fbe0f5d2501b7dd815806aef6fd9bad784eb1", "lessThan": "6055695ea40c64a47e00742c12c99b1a33b4daed", "status": "affected", "versionType": "git"}, {"version": "335fbe0f5d2501b7dd815806aef6fd9bad784eb1", "lessThan": "21c44a6895f41df811d1c91d10eea194dda2b345", "status": "affected", "versionType": "git"}, {"version": "335fbe0f5d2501b7dd815806aef6fd9bad784eb1", "lessThan": "5e46c76d9a5062212c4c5f642a5549fd9c057f8a", "status": "affected", "versionType": "git"}, {"version": "335fbe0f5d2501b7dd815806aef6fd9bad784eb1", "lessThan": "067e413eec2e63c2996909ef55214b3a0eda0be7", "status": "affected", "versionType": "git"}, {"version": "335fbe0f5d2501b7dd815806aef6fd9bad784eb1", "lessThan": "716f434eb35869e130424331584a91fbb729b9bd", "status": "affected", "versionType": "git"}, {"version": "335fbe0f5d2501b7dd815806aef6fd9bad784eb1", "lessThan": "6a65ac8a81e903bb4b555c1d13532f5cb0167a4a", "status": "affected", "versionType": "git"}, {"version": "335fbe0f5d2501b7dd815806aef6fd9bad784eb1", "lessThan": "aba1cf21954e64c36afb966b754adad2b0b8aa48", "status": "affected", "versionType": "git"}, {"version": "335fbe0f5d2501b7dd815806aef6fd9bad784eb1", "lessThan": "27c7d40008231ae4140d35501b60087a9de2d2c3", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/batman-adv/translation-table.c"], "versions": [{"version": "3.13", "status": "affected"}, {"version": "0", "lessThan": "3.13", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.261", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.212", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.178", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.145", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.97", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.40", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.5", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.13", "versionEndExcluding": "5.10.261"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.13", "versionEndExcluding": "5.15.212"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.13", "versionEndExcluding": "6.1.178"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.13", "versionEndExcluding": "6.6.145"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.13", "versionEndExcluding": "6.12.97"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.13", "versionEndExcluding": "6.18.40"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.13", "versionEndExcluding": "7.1.5"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.13", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/6055695ea40c64a47e00742c12c99b1a33b4daed"}, {"url": "https://git.kernel.org/stable/c/21c44a6895f41df811d1c91d10eea194dda2b345"}, {"url": "https://git.kernel.org/stable/c/5e46c76d9a5062212c4c5f642a5549fd9c057f8a"}, {"url": "https://git.kernel.org/stable/c/067e413eec2e63c2996909ef55214b3a0eda0be7"}, {"url": "https://git.kernel.org/stable/c/716f434eb35869e130424331584a91fbb729b9bd"}, {"url": "https://git.kernel.org/stable/c/6a65ac8a81e903bb4b555c1d13532f5cb0167a4a"}, {"url": "https://git.kernel.org/stable/c/aba1cf21954e64c36afb966b754adad2b0b8aa48"}, {"url": "https://git.kernel.org/stable/c/27c7d40008231ae4140d35501b60087a9de2d2c3"}], "title": "batman-adv: tt: avoid request storms during pending request", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/batman-adv/translation-table.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "6055695ea40c64a47e00742c12c99b1a33b4daed", "status": "affected", "version": "335fbe0f5d2501b7dd815806aef6fd9bad784eb1", "versionType": "git"}, {"lessThan": "21c44a6895f41df811d1c91d10eea194dda2b345", "status": "affected", "version": "335fbe0f5d2501b7dd815806aef6fd9bad784eb1", "versionType": "git"}, {"lessThan": "5e46c76d9a5062212c4c5f642a5549fd9c057f8a", "status": "affected", "version": "335fbe0f5d2501b7dd815806aef6fd9bad784eb1", "versionType": "git"}, {"lessThan": "067e413eec2e63c2996909ef55214b3a0eda0be7", "status": "affected", "version": "335fbe0f5d2501b7dd815806aef6fd9bad784eb1", "versionType": "git"}, {"lessThan": "716f434eb35869e130424331584a91fbb729b9bd", "status": "affected", "version": "335fbe0f5d2501b7dd815806aef6fd9bad784eb1", "versionType": "git"}, {"lessThan": "6a65ac8a81e903bb4b555c1d13532f5cb0167a4a", "status": "affected", "version": "335fbe0f5d2501b7dd815806aef6fd9bad784eb1", "versionType": "git"}, {"lessThan": "aba1cf21954e64c36afb966b754adad2b0b8aa48", "status": "affected", "version": "335fbe0f5d2501b7dd815806aef6fd9bad784eb1", "versionType": "git"}, {"lessThan": "27c7d40008231ae4140d35501b60087a9de2d2c3", "status": "affected", "version": "335fbe0f5d2501b7dd815806aef6fd9bad784eb1", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/batman-adv/translation-table.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "3.13"}, {"lessThan": "3.13", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.261", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.212", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.178", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.145", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.97", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.40", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.5", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbatman-adv: tt: avoid request storms during pending request\n\nbatadv_send_tt_request() allocates a tt_req_node when none exists for the\ndestination originator node. This should prevent that a multiple TT\nrequests are send at the same time to an originator.\n\nBut if allocation of the send buffer failed, this request must be cleaned\nup again. But indicator for such a failure is \"ret == false\". But the\nactual implementation is checking for \"ret == true\".\n\nThe check must be inverted to not loose the information about the TT\nrequest directly after it was attempted to be sent out. This should avoid\npotential request storms."}], "id": "CVE-2026-72231", "lastModified": "2026-08-17T06:18:24.377", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-08-15T06:21:50.000", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/067e413eec2e63c2996909ef55214b3a0eda0be7"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/21c44a6895f41df811d1c91d10eea194dda2b345"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/27c7d40008231ae4140d35501b60087a9de2d2c3"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/5e46c76d9a5062212c4c5f642a5549fd9c057f8a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/6055695ea40c64a47e00742c12c99b1a33b4daed"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/6a65ac8a81e903bb4b555c1d13532f5cb0167a4a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/716f434eb35869e130424331584a91fbb729b9bd"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/aba1cf21954e64c36afb966b754adad2b0b8aa48"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: batman-adv: tt: avoid request storms during pending request", "id": "2516403", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2516403"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-772", "details": ["A flaw was found in the batman-adv (Better Approach To Mobile Ad-hoc Networking) module of the Linux kernel. An incorrect check during the handling of TT (Topology Table) requests can prevent the proper cleanup of request nodes when send buffer allocation fails. This can lead to a remote attacker causing request storms, potentially resulting in a Denial of Service (DoS) condition."], "name": "CVE-2026-72231", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-15T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-72231\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-72231\nhttps://lore.kernel.org/linux-cve-announce/2026081549-CVE-2026-72231-bfeb@gregkh/T"], "threat_severity": "Moderate"}