CVE-2026-72229
In the Linux kernel, the following vulnerability has been resolved: batman-adv: clean untagged VLAN on netdev registration failure When an mesh interface is registered, it creates an untagged struct batadv_meshif_vlan on top of it via the NETDEV_REGISTER notifier. But in this process, another receiver of this notification can veto the registration. The netdev registration will be aborted because of this veto. The register_netdevice() call will try to clean up the net_device using unregister_netdevice_queue() - which only uses the .priv_destructor to free private resources. In this situation, .dellink will not be called. The cleanup of the untagged batadv_meshif_vlan must thefore be done in the destructor to avoid a leak of this object.
Affected versions
Linux kernel versions
3.13
and later are affected. Fixed in
5.10.261,
5.15.212,
6.1.178,
6.6.145,
6.12.97,
6.18.40,
7.1.5,
7.2-rc3
and their respective stable series.
References
8 totalFrequently asked questions
-
What is CVE-2026-72229?
CVE-2026-72229 is a unscored severity Linux kernel vulnerability . It affects Linux kernel versions from 3.13 onward and has been patched in 5.10.261, 5.15.212, 6.1.178 and others. CVE-2026-72229 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
-
Is there a patch available for CVE-2026-72229?
Yes. CVE-2026-72229 has been patched. Fixed versions include 5.10.261, 5.15.212, 6.1.178 and others. If you are running Linux kernel 3.13 or later up to the fix versions, apply the relevant patch for your kernel branch.
-
Is CVE-2026-72229 actively exploited?
No. CVE-2026-72229 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.