Skip to main content

Linux Kernel batman-adv CVE-2026-31659

| EUVDEUVD-2026-25552 CRITICAL
2026-04-24 Linux GHSA-8jfv-frvf-4g4v
Information Disclosure Linux
9.8
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
8.3 HIGH

batman-adv needs L2 mesh membership so AV:A not AV:N; mesh is unauthenticated (PR:N); out-of-bounds heap write is primarily integrity/availability (I:H/A:H) with only limited confidentiality (C:L).

3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H
4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
CRITICAL
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

6
Analysis Generated
Jul 24, 2026 - 02:44 vuln.today
Patch released
Apr 27, 2026 - 20:17 nvd
Patch available
CVSS changed
Apr 27, 2026 - 15:22 NVD
9.8 (CRITICAL)
Patch available
Apr 24, 2026 - 16:16 EUVD
EUVD ID Assigned
Apr 24, 2026 - 15:00 euvd
EUVD-2026-25552
CVE Published
Apr 24, 2026 - 14:45 nvd
CRITICAL 9.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

batman-adv: reject oversized global TT response buffers

batadv_tt_prepare_tvlv_global_data() builds the allocation length for a global TT response in 16-bit temporaries. When a remote originator advertises a large enough global TT, the TT payload length plus the VLAN header offset can exceed 65535 and wrap before kmalloc().

The full-table response path still uses the original TT payload length when it fills tt_change, so the wrapped allocation is too small and batadv_tt_prepare_tvlv_global_data() writes past the end of the heap object before the later packet-size check runs.

Fix this by rejecting TT responses whose TVLV value length cannot fit in the 16-bit TVLV payload length field.

AnalysisAI

Heap out-of-bounds write in the Linux kernel's batman-adv mesh routing subsystem lets a remote mesh originator corrupt kernel memory by advertising an oversized global translation table (TT). In batadv_tt_prepare_tvlv_global_data(), the allocation length is computed in 16-bit temporaries, so a large TT payload plus the VLAN header offset wraps past 65535 before kmalloc(), producing an undersized buffer that the full-table response path then overruns using the original (unwrapped) length. It is fixed across multiple stable kernel branches; there is no public exploit identified at time of analysis and EPSS is negligible (0.02%).

Technical ContextAI

batman-adv (B.A.T.M.A.N. Advanced) is an in-kernel Layer-2 mesh routing protocol that maintains a distributed translation table (TT) mapping client MAC addresses to originators, exchanged via TVLV (Type-Version-Length-Value) containers. The affected CPE is cpe:2.3:a:linux:linux (the mainline/stable kernel). The root cause is an integer overflow (CWE-190) in batadv_tt_prepare_tvlv_global_data(): the TVLV payload length field is 16 bits, and the code sums the advertised TT payload length with a per-VLAN header offset in 16-bit temporaries, allowing the value to wrap before the kmalloc() size argument is derived. Because the subsequent tt_change fill uses the original, un-wrapped payload length, the code writes past the end of the too-small heap object (CWE-787 out-of-bounds write / heap buffer overflow), and it does so before the later packet-size sanity check executes. NVD lists CWE as N/A; the class is best described as an integer-overflow-to-heap-overflow. The fix rejects TT responses whose TVLV value length cannot fit the 16-bit payload length field.

RemediationAI

Vendor-released patch: upgrade to a fixed stable kernel - 5.10.253, 5.15.203, 6.1.169, 6.6.135, 6.12.82, 6.18.23, 6.19.13, or mainline 7.0 (or your distribution's equivalent, e.g. via Ubuntu USN-8490-1 at https://ubuntu.com/security/notices/USN-8490-1, and Red Hat/SUSE kernel updates). The fix makes batman-adv reject TT responses whose TVLV value length cannot fit the 16-bit payload length field. Where immediate patching is not possible, the most effective compensating control is to not load/use batman-adv on hosts that do not need mesh routing - unload the module and blacklist it (e.g. 'modprobe -r batman_adv' plus a modprobe.d blacklist entry), which fully removes exposure at the cost of disabling mesh functionality on that host. On nodes that must run the mesh, restrict mesh membership to trusted, authenticated peers and segment the mesh L2 domain so untrusted devices cannot join and advertise global TT data; this shrinks the attacker population but does not eliminate risk if any peer is compromised. Confirm exact patched versions against the kernel.org stable commits (https://git.kernel.org/stable/c/95c71365a2222908441b54d6f2c315e0c79fcec3) before deploying.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Critical
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Share

CVE-2026-31659 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy