# CVE-2026-72228: batman-adv: frag: fix primary_if leak on failed linearization

Status: published. Published: 2026-08-15. Updated: 2026-11-06.

In the Linux kernel, the following vulnerability has been resolved:

batman-adv: frag: fix primary_if leak on failed linearization

If the skb has a frag_list, it must be linearized before it can be split
using skb_split(). But when this step failed, it must not only free the skb
but also take care of the reference to the already found primary_if.

## Remediation

No remediation reported in collected sources

## Affected products and versions

- Linux / Linux: ≥ a6a73781b460c4fe2cf2c40400ac91dfddb353fa; < e59b1960f71521ce4eb4397c4e82f5285601ab57 (affected, git); ≥ 8f37aad74f46dd5d8b95fac17804b75f77931fa9; < c1b28432fd6345e0d2308f39c507ed5750c265d2 (affected, git); ≥ a063f2fba3fa633a599253b62561051ac185fa99; < 4f3bf293f7662500142234ae6f23725953690bc9 (affected, git); ≥ a063f2fba3fa633a599253b62561051ac185fa99; < d2148aeee93197ccf821114489775132f28eebf5 (affected, git); ≥ a063f2fba3fa633a599253b62561051ac185fa99; < db3c700826e8126fbdaa83468a9c4ee4ee65319f (affected, git); ≥ a063f2fba3fa633a599253b62561051ac185fa99; < a90f4fff9025371bce5371daa610af957de8dd6a (affected, git); ≥ a063f2fba3fa633a599253b62561051ac185fa99; < 777a88256d6f70672116e53400659cc417e1feaa (affected, git); ≥ a063f2fba3fa633a599253b62561051ac185fa99; < 353d2c1d5492e53ae34f490a84494124dc3d3531 (affected, git); 5ed837a7e05bcba72bdcd86b12547ea5b796cc01 (affected, git); 5853618b022b8ed287a278540303e1b283d6f247 (affected, git); 3915341a935f3397f65a01580dc3bfc4cdf53d14 (affected, git); bea410635595f8efbec90c948da04c3613ef87ea (affected, git); ≥ 5.10.117; < 5.10.261 (affected, semver); ≥ 5.15.41; < 5.15.212 (affected, semver); ≥ 4.14.280; < 4.15 (affected, semver); ≥ 4.19.244; < 4.20 (affected, semver); ≥ 5.4.195; < 5.5 (affected, semver); ≥ 5.17.9; < 5.18 (affected, semver). Source: CNA: Linux
- Linux / Linux: 5.18 (affected); ≥ 0; < 5.18 (unaffected, semver); ≥ 5.10.261; ≤ 5.10.* (unaffected, semver); ≥ 5.15.212; ≤ 5.15.* (unaffected, semver); ≥ 6.1.178; ≤ 6.1.* (unaffected, semver); ≥ 6.6.145; ≤ 6.6.* (unaffected, semver); ≥ 6.12.97; ≤ 6.12.* (unaffected, semver); ≥ 6.18.40; ≤ 6.18.* (unaffected, semver); ≥ 7.1.5; ≤ 7.1.* (unaffected, semver); ≥ 7.2; ≤ * (unaffected, original_commit_for_fix). Source: CNA: Linux

## Severity and prioritization

- CISA KEV: No listing in collected sources

- EPSS: 0.22% as of 2026-11-06; percentile 12.55%

- SSVC: exploitation none; automatable no; technical impact partial; source ADP: CISA-ADP

- Weaknesses: Not reported

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://git.kernel.org/stable/c/e59b1960f71521ce4eb4397c4e82f5285601ab57 (CNA: Linux)

- https://git.kernel.org/stable/c/c1b28432fd6345e0d2308f39c507ed5750c265d2 (CNA: Linux)

- https://git.kernel.org/stable/c/4f3bf293f7662500142234ae6f23725953690bc9 (CNA: Linux)

- https://git.kernel.org/stable/c/d2148aeee93197ccf821114489775132f28eebf5 (CNA: Linux)

- https://git.kernel.org/stable/c/db3c700826e8126fbdaa83468a9c4ee4ee65319f (CNA: Linux)

- https://git.kernel.org/stable/c/a90f4fff9025371bce5371daa610af957de8dd6a (CNA: Linux)

- https://git.kernel.org/stable/c/777a88256d6f70672116e53400659cc417e1feaa (CNA: Linux)

- https://git.kernel.org/stable/c/353d2c1d5492e53ae34f490a84494124dc3d3531 (CNA: Linux)

- https://git.kernel.org/stable/c/353d2c1d5492e53ae34f490a84494124dc3d3531 (416baaa9-dc9f-4396-8d5f-8c081fb06d67)

- https://git.kernel.org/stable/c/4f3bf293f7662500142234ae6f23725953690bc9 (416baaa9-dc9f-4396-8d5f-8c081fb06d67)

- https://git.kernel.org/stable/c/777a88256d6f70672116e53400659cc417e1feaa (416baaa9-dc9f-4396-8d5f-8c081fb06d67)

- https://git.kernel.org/stable/c/a90f4fff9025371bce5371daa610af957de8dd6a (416baaa9-dc9f-4396-8d5f-8c081fb06d67)

- https://git.kernel.org/stable/c/c1b28432fd6345e0d2308f39c507ed5750c265d2 (416baaa9-dc9f-4396-8d5f-8c081fb06d67)

- https://git.kernel.org/stable/c/d2148aeee93197ccf821114489775132f28eebf5 (416baaa9-dc9f-4396-8d5f-8c081fb06d67)

- https://git.kernel.org/stable/c/db3c700826e8126fbdaa83468a9c4ee4ee65319f (416baaa9-dc9f-4396-8d5f-8c081fb06d67)

- https://git.kernel.org/stable/c/e59b1960f71521ce4eb4397c4e82f5285601ab57 (416baaa9-dc9f-4396-8d5f-8c081fb06d67)

## Provenance

- CNA: Linux: https://www.cve.org/CVERecord?id=CVE-2026-72228; retrieved 2026-11-06; source updated 2026-11-06

- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-72228; retrieved 2026-11-06; source updated 2026-11-06

- FIRST EPSS: https://api.first.org/data/v1/epss?cve=CVE-2026-72228; retrieved 2026-11-06; source updated Not reported

Revision: c18e184fe475493568536eba6bf8c2d43d0245b3bdcdeda3723f65175a802959

Canonical: https://y2.dev/cve/CVE-2026-72228

## Agent and API access

Public CVE pages, Markdown, and JSON are free to read without an account or API key.

- Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end.

- WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers.

- Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}.

- Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer <Y2_API_KEY>. Setup: https://y2.dev/docs/api/create-key.

- x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402.

- OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json.

Collected public records only. Check source status for coverage and freshness.