---
id: CVE-2026-72228
title: 'batman-adv: frag: fix primary_if leak on failed linearization'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  batman-adv: frag: fix primary_if leak on failed linearization

  If the skb has a frag_list, it must be linearized before it can be split
  using skb_split(). But when this…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= a6a73781b460c4fe2cf2c40400ac91dfddb353fa <
    e59b1960f71521ce4eb4397c4e82f5285601ab57
  - >-
    Linux >= 8f37aad74f46dd5d8b95fac17804b75f77931fa9 <
    c1b28432fd6345e0d2308f39c507ed5750c265d2
  - >-
    Linux >= a063f2fba3fa633a599253b62561051ac185fa99 <
    4f3bf293f7662500142234ae6f23725953690bc9
  - >-
    Linux >= a063f2fba3fa633a599253b62561051ac185fa99 <
    d2148aeee93197ccf821114489775132f28eebf5
  - >-
    Linux >= a063f2fba3fa633a599253b62561051ac185fa99 <
    db3c700826e8126fbdaa83468a9c4ee4ee65319f
  - >-
    Linux >= a063f2fba3fa633a599253b62561051ac185fa99 <
    a90f4fff9025371bce5371daa610af957de8dd6a
  - >-
    Linux >= a063f2fba3fa633a599253b62561051ac185fa99 <
    777a88256d6f70672116e53400659cc417e1feaa
  - >-
    Linux >= a063f2fba3fa633a599253b62561051ac185fa99 <
    353d2c1d5492e53ae34f490a84494124dc3d3531
  - Linux 5ed837a7e05bcba72bdcd86b12547ea5b796cc01
  - Linux 5853618b022b8ed287a278540303e1b283d6f247
  - Linux 3915341a935f3397f65a01580dc3bfc4cdf53d14
  - Linux bea410635595f8efbec90c948da04c3613ef87ea
  - Linux >= 5.10.117 < 5.10.261
  - Linux >= 5.15.41 < 5.15.212
  - Linux >= 4.14.280 < 4.15
  - Linux >= 4.19.244 < 4.20
  - Linux >= 5.4.195 < 5.5
  - Linux >= 5.17.9 < 5.18
  - Linux 5.18
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-06T16:53:03.587081Z'
published: '2026-08-15'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T16:55:23.012Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-72228'
references:
  - url: 'https://git.kernel.org/stable/c/e59b1960f71521ce4eb4397c4e82f5285601ab57'
  - url: 'https://git.kernel.org/stable/c/c1b28432fd6345e0d2308f39c507ed5750c265d2'
  - url: 'https://git.kernel.org/stable/c/4f3bf293f7662500142234ae6f23725953690bc9'
  - url: 'https://git.kernel.org/stable/c/d2148aeee93197ccf821114489775132f28eebf5'
  - url: 'https://git.kernel.org/stable/c/db3c700826e8126fbdaa83468a9c4ee4ee65319f'
  - url: 'https://git.kernel.org/stable/c/a90f4fff9025371bce5371daa610af957de8dd6a'
  - url: 'https://git.kernel.org/stable/c/777a88256d6f70672116e53400659cc417e1feaa'
  - url: 'https://git.kernel.org/stable/c/353d2c1d5492e53ae34f490a84494124dc3d3531'
tags:
  - cve.org
epss: 0.0022
epssPercentile: 0.12539
ingestedAt: '2026-11-06T18:00:12.587Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

batman-adv: frag: fix primary_if leak on failed linearization

If the skb has a frag_list, it must be linearized before it can be split
using skb_split(). But when this step failed, it must not only free the skb
but also take care of the reference to the already found primary_if.

## Affected

- `Linux >= a6a73781b460c4fe2cf2c40400ac91dfddb353fa < e59b1960f71521ce4eb4397c4e82f5285601ab57`
- `Linux >= 8f37aad74f46dd5d8b95fac17804b75f77931fa9 < c1b28432fd6345e0d2308f39c507ed5750c265d2`
- `Linux >= a063f2fba3fa633a599253b62561051ac185fa99 < 4f3bf293f7662500142234ae6f23725953690bc9`
- `Linux >= a063f2fba3fa633a599253b62561051ac185fa99 < d2148aeee93197ccf821114489775132f28eebf5`
- `Linux >= a063f2fba3fa633a599253b62561051ac185fa99 < db3c700826e8126fbdaa83468a9c4ee4ee65319f`
- `Linux >= a063f2fba3fa633a599253b62561051ac185fa99 < a90f4fff9025371bce5371daa610af957de8dd6a`
- `Linux >= a063f2fba3fa633a599253b62561051ac185fa99 < 777a88256d6f70672116e53400659cc417e1feaa`
- `Linux >= a063f2fba3fa633a599253b62561051ac185fa99 < 353d2c1d5492e53ae34f490a84494124dc3d3531`
- `Linux 5ed837a7e05bcba72bdcd86b12547ea5b796cc01`
- `Linux 5853618b022b8ed287a278540303e1b283d6f247`
- `Linux 3915341a935f3397f65a01580dc3bfc4cdf53d14`
- `Linux bea410635595f8efbec90c948da04c3613ef87ea`
- `Linux >= 5.10.117 < 5.10.261`
- `Linux >= 5.15.41 < 5.15.212`
- `Linux >= 4.14.280 < 4.15`
- `Linux >= 4.19.244 < 4.20`
- `Linux >= 5.4.195 < 5.5`
- `Linux >= 5.17.9 < 5.18`
- `Linux 5.18`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.