CVE-2026-72232

This CVE exposes a fundamental shift in how the kernel handles packet trust boundaries that defenders need to understand. The vulnerability in batadv_interface_tx() is an out-of-bounds read triggered when an skb arriving from an eBPF TC hook lacks a valid Ethernet header (less than ETH_HLEN bytes). The CVSS 7.8 scores the memory disclosure, but the deeper story is architectural: batman-adv was written under an implicit contract that upstream network code would never pass it malformed packets—because historically, that contract held. eBPF TC hooks broke that contract by allowing packet truncation and redirect before data reaches batman-adv, creating a path that never existed during the module's development (roughly 2007-2012). The fix—adding explicit ETH_HLEN validation before dereferencing skb->data—is correct and necessary. But it represents a defensive posture shift: batman-adv now validates input that it previously assumed would be guaranteed by upstream code. This isn't a coding oversight; it's a case where the kernel's implicit trust model evolved without a mechanism to notify downstream consumers. The practical implications for defenders: First, audit other network protocol handlers that predate widespread eBPF TC adoption (circa 2015+) and make assumptions about packet header structure. The pattern of ETH_HLEN validations appearing across the kernel is likely a leading indicator of a vulnerability class, not isolated fixes. Second, the exploitation complexity question matters: reliable out-of-bounds heap read requires controlled eBPF hooks and stable heap layout, which limits practical severity—but the attack surface exists regardless. Third, consider the architectural gap: there's no mechanism for upstream capabilities to publish constraints to downstream consumers, meaning the same pattern will likely recur when new packet manipulation features land. The vulnerability was dormant for years—eBPF TC didn't introduce the bug, it revealed it. The fix closes one instance; whether the class gets audited systematically remains an open question.

Reviewed through automated stages and approved by a human before publication.