Security readout for executives and security teams
Plain-English summary
A Linux batman-adv networking flaw can leave code using memory after a packet buffer is reallocated. The supplied CVSS assessment indicates potentially severe confidentiality, integrity, and availability impact, but the sources do not document demonstrated attack outcomes or required traffic conditions.
Executive priority
Prioritize rapid exposure assessment and vendor-supported patching for mesh-network nodes, appliances, and embedded Linux systems using batman-adv. Internet-facing status alone may not describe exposure because the vulnerable path concerns mesh packet processing. Systems without batman-adv usage are lower priority pending confirmation.
Technical view
Within batman-adv DAT processing, batadv_get_vid() calls pskb_may_pull(), which may reallocate the skb buffer. A previously acquired ARP hardware-source pointer can then reference freed memory, creating a use-after-free. The referenced stable-kernel commits move pointer acquisition until after possible reallocation.
Likely exposure
Exposure is most likely on Linux systems using affected kernels with batman-adv and its distributed ARP table functionality active. The supplied version data lists releases from 5.1 through 7.2, but its flattened entries, duplicate hash, and unexplained “0” make exact affected-range interpretation uncertain. Confirm status through distribution or vendor advisories.
Exploitation context
The supplied record assigns CVSS 3.1 score 9.8 with network reachability, low complexity, no privileges, and no user interaction. However, it provides no exploit demonstration or active-exploitation evidence, and KEV is false. Treat the score seriously while recognizing that practical reachability and prerequisites remain insufficiently documented.
Researcher notes
The core defect and remediation pattern are clearly described, but the bundle does not establish reachable packet conditions, reproducibility, exploitation impact, or a precise version-range mapping. The affected-version list appears machine-flattened and contains anomalies. Avoid treating the CVSS vector as proof of demonstrated remote code execution.
Mitigation direction
- Apply a vendor-supported kernel update incorporating the applicable referenced stable-kernel fix.
- Check distribution or appliance guidance for affected versions and backported fixes.
- If patching is delayed, assess disabling unused batman-adv or DAT functionality where operationally acceptable.
- Restrict untrusted access to affected mesh-network interfaces while awaiting vendor guidance.
Validation and detection
- Inventory kernel versions on systems and appliances that may use batman-adv.
- Confirm whether batman-adv is present, loaded, and participating in mesh networking.
- Determine whether distributed ARP table functionality is enabled or exercised.
- Compare vendor package changelogs against CVE-2026-80600 or the referenced fix commits.
- After updating, verify the running kernel contains the vendor-confirmed backport.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2026-80600 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9LinuxVulnerability scoring details
Base CVSS 3.1 score
9.8CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/a82fc217cb7a447313c76ebf9f09b100771b0ddfCVE reference, Linux
- https://git.kernel.org/stable/c/86aa79b43e5b561fd3648891165bd7313b541315CVE reference, Linux
- https://git.kernel.org/stable/c/d755cd001fa2c248e186c1fc3df3d11d97dc843cCVE reference, Linux
- https://git.kernel.org/stable/c/3404be97b940a9b1ae1aea5fdbc6cdbbe9cd5146CVE reference, Linux
- https://git.kernel.org/stable/c/01678c53a7717a748aee388b6839e7b9761d641cCVE reference, Linux
- https://git.kernel.org/stable/c/3b4c70c40f2e135a50cd38fc61c7d23a296a9981CVE reference, Linux
- https://git.kernel.org/stable/c/059a70e1d12d6d99310e0599d37b0323557569a8CVE reference, Linux
- https://git.kernel.org/stable/c/48067b2ae4504500a7093d9e1e16b42e70330480CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.