Heap buffer overflow in Linux kernel batman-adv TT response handling (CVE-2026-31659)

The batman-adv subsystem in the Linux kernel computes the allocation length for a global translation table (TT) response using 16-bit temporaries. A remote originator advertising a sufficiently large global TT can cause the computed length to exceed 65535 and wrap, resulting in an undersized heap allocation. The full-table response path subsequently writes past the end of that heap object before any packet-size check executes, enabling an out-of-bounds heap write that an attacker could use to compromise the system. Affected versions: - Ubuntu 25.10 We recommend updating to: 6.17.0-1018.18, 6.17.0-1019.19, 6.17.0-1020.22, 6.17.0-40.40. CVSS 9.8 · our assessment: act_now Reference: https://ubuntu.com/security/notices/USN-8490-1 Details: https://vuln.today/cve/CVE-2026-31659