A use-after-free vulnerability in the Linux kernel batman-adv module could allow an adjacent attacker to trigger memory corruption and potentially achieve arbitrary code execution.

The vulnerability exists in the batadv_get_vid function within the batman-adv module. When pskb_may_pull is called, it may trigger a buffer reallocation, causing existing pointers to become invalid and resulting in a use-after-free condition. This flaw is exploitable by an unauthenticated attacker on the local network segment.

The vulnerability carries a CVSS score of 8.8, reflecting its potential for high impact on system integrity, confidentiality, and availability. Successful exploitation allows an attacker to cause system crashes (Denial of Service) or potentially execute malicious code with kernel-level privileges, which could lead to full system compromise and unauthorized data access.

Immediate Action: Update the Linux kernel to version 5.10.261, 5.15.212, 6.1.178, 6.6.145, or the latest stable release provided by your distribution vendor.

Proactive Monitoring: Monitor system logs for kernel panic events or unexpected service interruptions associated with the batman-adv network module.

Compensating Controls: Restrict network access to the affected interfaces to trusted devices only, as the attack vector requires adjacency to the vulnerable host.

Public Exploit Available: No

Given the severity of potential kernel-level exploitation, organizations must prioritize patching the Linux kernel across all affected infrastructure. System administrators should verify their current kernel version and apply the recommended updates immediately to eliminate the risk of memory corruption and unauthorized code execution.