CVE-2026-72227 Linux CVE debrief

Who should care

Linux kernel developers and maintainers, network administrators, and users of Linux-based systems should be aware of this vulnerability. Developers and maintainers should review and apply the provided patches to the Linux kernel. Network administrators should ensure that Linux-based systems under their management are updated to a version of the kernel that includes the fix. Users of Linux-based systems should also be aware of this vulnerability and encourage their administrators to apply the necessary updates. Additionally, security teams and vulnerability management teams should be aware of this vulnerability and assess their exposure to affected systems. Operators of Linux-based platforms should review their system configurations and update their kernels as necessary. Those responsible for vulnerability management and security operations should monitor for potential exploitation attempts and review system logs for signs of compromise. Asset inventory management teams should ensure that all Linux-based assets are accounted for and updated. Those responsible for change management and rollback/change windows should plan and implement updates in accordance with their organization's change control processes. Source tracking and monitoring teams should be aware of this vulnerability and track its exploitation in their environments. Compensating controls, such as monitoring and detection, should be reviewed and updated to account for this vulnerability. Those responsible for incident response and remediation should be prepared to address potential exploitation of this vulnerability. Teams responsible for asset inventory, patch management, and security configuration should prioritize this vulnerability for remediation based on its severity and potential impact. Those responsible for security awareness and training should inform users about this vulnerability and the importance of keeping their systems updated. Teams responsible for threat hunting and threat intelligence should be aware of this vulnerability and monitor for potential exploitation attempts. Those responsible for compliance and regulatory requirements should ensure that their organization's Linux-based,

Technical summary

The batman-adv module in the Linux kernel has a vulnerability in the mcast component. The issue arises from the incorrect use of offsetof() instead of offsetofend() to check for the whole size of the num_dests header. This can lead to an out-of-bounds read when accessing the num_dests header. The vulnerability can be mitigated by applying the provided patches to the Linux kernel. Affected Linux kernel developers and maintainers should review the patches and update their kernels accordingly. Network administrators and users of Linux-based systems should also be aware of this vulnerability and take steps to ensure their systems are updated.

Defensive priority

Medium

Recommended defensive actions

• Review and apply the provided patches to the Linux kernel
• Ensure that the Linux kernel is updated to a version that includes the fix
• Monitor network traffic and system logs for potential exploitation attempts
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The vulnerability exists in the batman-adv module of the Linux kernel, specifically in the mcast component. An out-of-bounds read can occur due to incorrect checks on the network header length. The issue arises from the use of offsetof() instead of offsetofend() to check for the whole size of the num_dests header. This can lead to accessing memory beyond the bounds of the available data.

Official resources