CVE-2026-72227: batman-adv: mcast: avoid OOB read of num_dests header

CVE-2026-72227: batman-adv: mcast: avoid OOB read of num_dests header

[Greg Kroah-Hartman]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

batman-adv: mcast: avoid OOB read of num_dests header

Before the access to struct batadv_tvlv_mcast_tracker's num_dests, it is
attempted to check whether enough space is actually in the network header.
But instead of using offsetofend() to check for the whole size (2) which
must be accessible, offsetof() of is called. The latter is always returning
0. The comparison with the network header length will always return that
enough data is available - even when only 1 or 0 bytes are accessible.

Instead of using offsetofend(), use the more common check for the whole
header.

The Linux kernel CVE team has assigned CVE-2026-72227 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 6.8 with commit 07afe1ba288c04280622fa002ed385f1ac0b6fe6 and fixed in 6.12.97 with commit 80f62893d135f415e7a374dd47b468ec298f7aed
	Issue introduced in 6.8 with commit 07afe1ba288c04280622fa002ed385f1ac0b6fe6 and fixed in 6.18.40 with commit d2b657c9653fcebca828a2ead13f444e0da68817
	Issue introduced in 6.8 with commit 07afe1ba288c04280622fa002ed385f1ac0b6fe6 and fixed in 7.1.5 with commit 7d1a877670bc2e901241073f022ca8d1b2f85f1c
	Issue introduced in 6.8 with commit 07afe1ba288c04280622fa002ed385f1ac0b6fe6 and fixed in 7.2-rc3 with commit 38eaed28e250895d56f4b7989bd65479a511c5c3

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-72227
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	net/batman-adv/multicast_forw.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/80f62893d135f415e7a374dd47b468ec298f7aed
	https://git.kernel.org/stable/c/d2b657c9653fcebca828a2ead13f444e0da68817
	https://git.kernel.org/stable/c/7d1a877670bc2e901241073f022ca8d1b2f85f1c
	https://git.kernel.org/stable/c/38eaed28e250895d56f4b7989bd65479a511c5c3