Sven Eckelmann 48067b2ae4 batman-adv: dat: acquire ARP hw source only after skb realloc ...

The pskb_may_pull() called by batadv_get_vid() could reallocate the buffer
behind the skb. Variables which were pointing to the old buffer need to be
reassigned to avoid an use-after-free.

Cc: stable@vger.kernel.org
Fixes: b61ec31c85 ("batman-adv: Snoop DHCPACKs for DAT")
Signed-off-by: Sven Eckelmann <sven@narfation.org>

2026-06-28 09:58:29 +02:00

..

6lowpan

6lowpan: fix NHC entry use-after-free on error path

2026-06-11 15:27:07 -07:00

9p

9p: Add missing read barrier in virtio zero-copy path

2026-06-21 05:22:57 +00:00

802

appletalk: move the protocol out of tree

2026-06-16 14:37:06 -07:00

8021q

vlan: defer real device state propagation to netdev_work

2026-06-25 10:18:40 -07:00

atm

Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

2026-06-16 14:59:58 -07:00

batman-adv

batman-adv: dat: acquire ARP hw source only after skb realloc

2026-06-28 09:58:29 +02:00

bluetooth

Bluetooth: L2CAP: validate connectionless PSM length

2026-06-11 14:24:41 -04:00

bpf

Merge tag 'bpf-next-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next

2026-06-17 09:18:14 +01:00

bridge

netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak

2026-06-21 00:18:37 +02:00

can

Merge tag 'net-next-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next

2026-04-14 18:36:10 -07:00

ceph

libceph: Fix potential null-ptr-deref in decode_choose_args()

2026-05-12 21:00:59 +02:00

core

Merge tag 'net-7.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

2026-06-25 12:25:36 -07:00

dcb

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

devlink

devlink: Fix parent ref leak on tc-bw failure

2026-06-18 18:02:29 -07:00

dns_resolver

net/dns_resolver: use kasprintf + kmemdup_nul to simplify dns_query

2026-06-04 18:39:29 -07:00

dsa

net: dsa: tag_yt921x: handle ACL tag code

2026-06-10 08:26:05 -07:00

ethernet

bonding: prevent potential infinite loop in bond_header_parse()

2026-03-16 19:29:45 -07:00

ethtool

net: ethtool: keep rtnl_lock for ops using ethtool_op_get_link()

2026-06-25 10:18:34 -07:00

handshake

handshake: Require admin permission for DONE command

2026-06-12 15:45:44 -07:00

hsr

net: hsr: simplify fill_last_seq_nrs()

2026-06-12 16:20:28 -07:00

ieee802154

ieee802154: allow legacy LLSEC ADD/DEL ops to pass strict validation

2026-06-19 23:02:42 +02:00

ife

net: ife: require ETH_HLEN to be pullable in ife_decode()

2026-06-13 17:34:39 -07:00

ipv4

Merge tag 'net-7.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

2026-06-25 12:25:36 -07:00

ipv6

ipv6: fix missing notification for ignore_routes_with_linkdown

2026-06-23 19:12:48 -07:00

iucv

Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

2026-05-28 14:02:21 -07:00

kcm

Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

2026-06-16 14:59:58 -07:00

key

Merge tag 'ipsec-2026-06-22' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec

2026-06-23 16:22:24 -07:00

l2tp

Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

2026-06-04 15:29:04 -07:00

l3mdev

…

lapb

…

llc

net: llc: make empty have static storage duration

2026-06-18 17:52:56 -07:00

mac80211

Merge tag 'wireless-next-2026-06-10' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless-next

2026-06-10 07:59:45 -07:00

mac802154

mac802154: Prevent overwrite return code in mac802154_perform_association()

2026-06-19 22:55:16 +02:00

mctp

mctp: convert to getsockopt_iter

2026-05-10 10:11:07 -07:00

mpls

net: Remove rtnl_held of struct fib_dump_filter.

2026-06-08 17:06:23 -07:00

mptcp

mptcp: options: rst: drop unused skb parameter

2026-06-11 15:33:39 -07:00

ncsi

net: ncsi: fix skb leak in error paths

2026-03-06 17:34:48 -08:00

netfilter

netfilter: nf_conntrack_helper: cap maximum number of expectation at helper registration

2026-06-23 13:10:48 +02:00

netlabel

Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

2026-06-11 14:33:35 -07:00

netlink

Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

2026-05-28 14:02:21 -07:00

nfc

nfc: nci: uart: Constify struct tty_ldisc_ops

2026-06-11 20:21:32 +02:00

nsh

…

openvswitch

openvswitch: conntrack: annotate ct limit hlist traversal

2026-06-25 08:38:00 -07:00

packet

net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd()

2026-04-22 20:16:34 -07:00

phonet

net: phonet: free phonet_device after RCU grace period

2026-06-08 17:37:07 -07:00

psample

net: psample: fix info leak in PSAMPLE_ATTR_DATA

2026-06-17 16:35:50 -07:00

psp

psp: add a new netdev event for dev unregister

2026-06-12 18:31:32 -07:00

qrtr

Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

2026-06-16 14:59:58 -07:00

rds

Merge tag 'net-7.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

2026-06-25 12:25:36 -07:00

rfkill

rfkill: Replace strcpy() with memcpy()

2026-06-10 10:22:47 +02:00

rxrpc

rxrpc: Fix rxrpc_rotate_tx_rotate() to check there's something to rotate

2026-06-25 10:07:19 -07:00

sched

net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle

2026-06-23 19:08:36 -07:00

sctp

sctp: fix err_chunk memory leaks in INIT handling

2026-06-23 19:09:26 -07:00

shaper

net: shaper: add a note that we expect cap dumps to be tiny

2026-06-11 12:55:23 +02:00

smc

Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

2026-05-28 14:02:21 -07:00

strparser

net: strparser: fix skb_head leak in strp_abort_strp()

2026-04-14 12:37:00 +02:00

sunrpc

Merge tag 'nfs-for-7.2-1' of git://git.linux-nfs.org/projects/anna/linux-nfs

2026-06-23 18:36:41 -07:00

switchdev

bridge: No DEV_PATH_BR_VLAN_UNTAG_HW for dsa foreign

2026-03-19 13:14:00 +01:00

tipc

tipc: avoid busy looping in tipc_exit_net()

2026-06-25 08:53:00 -07:00

tls

net: skmsg: preserve sg.copy across SG transforms

2026-06-16 14:38:46 -07:00

unix

Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

2026-06-04 15:29:04 -07:00

vmw_vsock

vsock: fold sk_acceptq_removed() into vsock_remove_pending()

2026-06-13 10:39:26 -07:00

wireless

Merge tag 'wireless-next-2026-06-10' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless-next

2026-06-10 07:59:45 -07:00

x25

x25: convert to getsockopt_iter

2026-05-10 10:11:08 -07:00

xdp

Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

2026-06-04 15:29:04 -07:00

xfrm

Merge tag 'ipsec-2026-06-22' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec

2026-06-23 16:22:24 -07:00

compat.c

net: Remove support for AIO on sockets

2026-05-29 14:05:30 +08:00

devres.c

…

Kconfig

appletalk: move the protocol out of tree

2026-06-16 14:37:06 -07:00

Kconfig.debug

…

Makefile

appletalk: move the protocol out of tree

2026-06-16 14:37:06 -07:00

socket.c

Merge tag 'net-next-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next

2026-06-17 08:17:00 +01:00

sysctl_net.c

…