In the Linux kernel, the following vulnerability has been resolved: batman-adv: dat: acquire ARP hw source only after skb realloc The pskb_may_pull() called by batadv_get_vid() could reallocate the buffer behind the skb. Variables which were pointing to the old buffer need to be reassigned to avoid an use-after-free.
Casky was already ahead
This CVE exploits attack patterns that Casky's 0matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.
CVE-2026-80600 is a use-after-free vulnerability in the Linux kernel's batman-adv (Better Approach To Mobile Ad-hoc Networking) module, specifically in the Distributed ARP Table (DAT) component. The flaw occurs when pskb_may_pull() reallocates the socket buffer (skb) during ARP hardware source address retrieval, leaving stale pointers that reference freed memory. This critical vulnerability (CVSS 9.8) affects Linux systems running batman-adv, particularly those deployed in mesh networking environments, embedded devices, and IoT infrastructure. Exploitation could lead to kernel memory corruption, information disclosure, or denial of service, making it a high-priority patch for any organization maintaining batman-adv-enabled systems.
Casky's approach to detecting attacks exploiting this vulnerability would focus on identifying memory safety violations and unusual kernel behavior patterns. Practitioners using Casky would recognize attack indicators mapped to MITRE ATT&CK techniques such as T1203 (Exploitation for Privilege Escalation) and T1499 (Endpoint Denial of Service), as the use-after-free typically manifests through unexpected kernel panics, memory access violations, or privilege boundary violations. Extended reasoning analysis would correlate suspicious batman-adv packet handling activity with kernel crash logs and memory protection alerts, helping security teams distinguish legitimate batman-adv mesh traffic from malicious payloads crafted to trigger the buffer reallocation race condition. Detection would emphasize abnormal ARP processing sequences and correlate kernel sanitizer warnings with network-level indicators of exploitation attempts.
Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →
Casky has 0 skills that investigate the attack patterns behind CVE-2026-80600. Run one and get CVSS-scored findings in 3 minutes.
Run the skill that detects this →© 2026 Casky.AI, Inc. · AI Security Investigation