CVE-2026-72235

The vulnerability in batman-adv's receive path is a textbook stale pointer bug: `pskb_may_pull()` can reallocate the skb's backing memory, invalidating any cached header pointers, yet the ethernet header pointer was not refreshed after this call while the VLAN header pointer was. When TT (translation table) and AP isolation logic dereferences this stale pointer, it triggers a use-after-free. The developers demonstrably understood the requirement—the VLAN header pointer is correctly reassigned in the same function—but the ethernet path was missed, likely because the developer was focused on the VLAN change and applied the fix locally without auditing unrelated header pointers in the same block. This 'local coherence without global coverage' failure mode is the operative risk. The fix is trivial (reassign `ethhdr` after `pskb_may_pull()`), but the structural question is whether batman-adv has other code paths with the same pattern: `pskb_may_pull()` followed by multiple skb header pointer dereferences where only some pointers were refreshed. Audit functions in the TX path, fragmentation handling, and multi-interface scenarios for this exact pattern. The deeper concern is that TT and AP isolation logic—which makes routing decisions affecting mesh topology—depends on this pointer, meaning the blast radius of a stale dereference extends beyond local crash to potential table state corruption propagating through the mesh protocol. For prioritization: treat any batman-adv code touching `pskb_may_pull()` with multiple header pointer accesses as high-risk until audited.

Reviewed through automated stages and approved by a human before publication.