CVE-2026-72233 is a use-after-free in batman-adv's BLA (Bridge Loop Avoidance) code where a pointer to skb data is captured before pskb_may_pull() may reallocate the underlying buffer, then used afterward while stale. The CVSS 8.8 rating warrants scrutiny—the actual exploitability is narrower than the score suggests, but the blast radius if exploitation succeeds is broader than CVSS captures.
The pskb_may_pull() race window is constrained to a specific BLA code path during bridge forwarding decisions in batman-adv mesh networks. Triggering the UAF requires a crafted packet that traverses this exact code while simultaneously causing buffer reallocation—neither condition is trivial to arrange. An attacker needs either local access to inject packets into the mesh or a man-in-the-middle position. This isn't a generic kernel UAF offering straightforward local privilege escalation.
However, dismissing this as low-risk because EPSS shows 0.34% probability would be a mistake. Historical precedent shows that vulnerabilities in specialized subsystems dismissed as "hard to trigger" often become practical once tooling matures. More concerning: batman-adv has received less security scrutiny than core kernel networking—similar anti-patterns were caught and remediated in netfilter years ago, but this BLA code path hasn't been through that adversarial gauntlet.
The severity question also hinges on what successful exploitation actually compromises. A UAF here doesn't just give you one node—it gives you that node's forwarding authority over an entire mesh segment. Other nodes will continue trusting that compromised gateway's BLA claims, propagating corrupt routing state across the topology. This is network-segment compromise, not host compromise, and CVSS doesn't model transitive authority well.
Deployments matter enormously. Batman-adv runs in community mesh networks, emergency infrastructure, and embedded systems where nodes often persist for years past kernel EOL. Abandoned mesh nodes don't vanish from the topology—they linger as trusted backbone gateways still executing the vulnerable code path. The exposure window isn't just the theoretical race condition; it's years of unpatched nodes with forwarding authority that will never receive updates.
Prioritize patching in any batman-adv deployment. If immediate patching isn't feasible, audit mesh topology for abandoned nodes and remove them from the backbone gateway set. The risk isn't just the vulnerability—it's the intersection of narrow-but-real exploitability, network-segment impact, and prolonged exposure in mesh environments that rarely see security updates.