CVE-2026-72227 batman-adv: mcast: avoid OOB read of num_dests header
An out-of-bounds read in the batman-adv multicast module allows attackers to read kernel memory or cause a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-72227?
CVE-2026-72227 is a high-severity memory corruption vulnerability in Linux, published on 15 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
batman-adv: mcast: avoid OOB read of num_dests header
Before the access to struct batadv_tvlv_mcast_tracker's num_dests, it is attempted to check whether enough space is actually in the network header. But instead of using offsetofend() to check for the whole size (2) which must be accessible, offsetof() of is called. The latter is always returning 0. The comparison with the network header length will always return that enough data is available - even when only 1 or 0 bytes are accessible.
Instead of using offsetofend(), use the more common check for the whole header.
Which versions are affected by CVE-2026-72227?
How do I fix CVE-2026-72227?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-72227 being exploited?
There is no known exploitation of CVE-2026-72227 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-72227, DEBIAN-CVE-2026-72227, GHSA-h862-94w3-mqrr, UBUNTU-CVE-2026-72227.