High 8.1Published Aug 28, 2026

CVE-2026-80599batman-adv: dat: ensure accessible eth_hdr proto field

Updated under an hour ago (2026-10-19 08:00 UTC)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: batman-adv: dat: ensure accessible eth_hdr proto field When batadv_get_vid() accesses the proto field of the ethernet header, it is not checking if the data itself is accessible. The caller is responsible for it. But in contrast to other call sites, batadv_dat_get_vid() and its caller didn't make sure this is true. This could have caused an out-of-bounds access.

CVSS: 8.1 HIGH (v3.1, CNA)CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Received
Record last updated: Oct 16, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from be1db4f6615b5e6156c807ea8985171c215c2d57 before da3677b5ed362742d30ceab31bfafcdc74dc2642; from be1db4f6615b5e6156c807ea8985171c215c2d57 before 6d3ea37074bb747f745d28138f87745ba9bd97c5; from be1db4f6615b5e6156c807ea8985171c215c2d57 before 7913935d41f166c367bbf7cc76a79e50044388e8; from be1db4f6615b5e6156c807ea8985171c215c2d57 before 3c62694c31f043568c3f4784b8d247cc3bea6b4c; from be1db4f6615b5e6156c807ea8985171c215c2d57 before 5836a050d02e9598fa0f71e88dde28b63dfa35e3; from be1db4f6615b5e6156c807ea8985171c215c2d57 before 8f76277d02176cd739945bba3379448e2e22e799; from be1db4f6615b5e6156c807ea8985171c215c2d57 before 4407ff3af469356f9641c4a6e7072309bae86bea; from be1db4f6615b5e6156c807ea8985171c215c2d57 before 26560c4a03dc4d607331600c187f59ab2df5f341	CNA record

References

https://git.kernel.org/stable/c/da3677b5ed362742d30ceab31bfafcdc74dc2642
https://git.kernel.org/stable/c/6d3ea37074bb747f745d28138f87745ba9bd97c5
https://git.kernel.org/stable/c/7913935d41f166c367bbf7cc76a79e50044388e8
https://git.kernel.org/stable/c/3c62694c31f043568c3f4784b8d247cc3bea6b4c
https://git.kernel.org/stable/c/5836a050d02e9598fa0f71e88dde28b63dfa35e3
https://git.kernel.org/stable/c/8f76277d02176cd739945bba3379448e2e22e799
https://git.kernel.org/stable/c/4407ff3af469356f9641c4a6e7072309bae86bea
https://git.kernel.org/stable/c/26560c4a03dc4d607331600c187f59ab2df5f341

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.