CVE-2026-72227

Estado: RecibidaAlta (8.1)—

In the Linux kernel, the following vulnerability has been resolved:

batman-adv: mcast: avoid OOB read of num_dests header

Before the access to struct batadv_tvlv_mcast_tracker's num_dests, it is attempted to check whether enough space is actually in the network header. But instead of using offsetofend() to check for the whole size (2) which must be accessible, offsetof() of is called. The latter is always returning 0. The comparison with the network header length will always return that enough data is available - even when only 1 or 0 bytes are accessible.

Instead of using offsetofend(), use the more common check for the whole header.

CVSS

Versión: 3.1
Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Puntuación base: 8.1

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 0.39%
Percentil entre todas las CVEs puntuadas: 30
Fecha de la puntuación: 5/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

ExplotaciónT1210 Exploitation of Remote Serviceslateral movement60 %

Inferido por reglas deterministas a partir del vector CVSS y la CWE. Solo orientativo.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Vulnerability Scanning Threat Intelligence Program Privileged Account Management Network Segmentation Disable or Remove Feature or Program Application Isolation and Sandboxing

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux Kernel^AI

Referencias

JSON original (NVD)

Mostrar

{
  "id": "CVE-2026-72227",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.1,
          "attackVector": "ADJACENT_NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.2,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "07afe1ba288c04280622fa002ed385f1ac0b6fe6",
              "lessThan": "80f62893d135f415e7a374dd47b468ec298f7aed",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "07afe1ba288c04280622fa002ed385f1ac0b6fe6",
              "lessThan": "d2b657c9653fcebca828a2ead13f444e0da68817",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "07afe1ba288c04280622fa002ed385f1ac0b6fe6",
              "lessThan": "7d1a877670bc2e901241073f022ca8d1b2f85f1c",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "07afe1ba288c04280622fa002ed385f1ac0b6fe6",
              "lessThan": "38eaed28e250895d56f4b7989bd65479a511c5c3",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "net/batman-adv/multicast_forw.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.8"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "6.8",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver",
              "lessThanOrEqual": "7.1.*"
            },
            {
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "net/batman-adv/multicast_forw.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-08-15T06:21:49.510",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/38eaed28e250895d56f4b7989bd65479a511c5c3",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/7d1a877670bc2e901241073f022ca8d1b2f85f1c",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/80f62893d135f415e7a374dd47b468ec298f7aed",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/d2b657c9653fcebca828a2ead13f444e0da68817",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbatman-adv: mcast: avoid OOB read of num_dests header\n\nBefore the access to struct batadv_tvlv_mcast_tracker's num_dests, it is\nattempted to check whether enough space is actually in the network header.\nBut instead of using offsetofend() to check for the whole size (2) which\nmust be accessible, offsetof() of is called. The latter is always returning\n0. The comparison with the network header length will always return that\nenough data is available - even when only 1 or 0 bytes are accessible.\n\nInstead of using offsetofend(), use the more common check for the whole\nheader."
    }
  ],
  "lastModified": "2026-08-17T06:18:23.910",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}