Skip to main content

Linux Kernel CVE-2026-31683

| EUVDEUVD-2026-25650 HIGH
2026-04-25 Linux
Buffer Overflow Linux
7.8
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.8 HIGH

Local access with low privileges triggers kernel heap overflow via runtime aggregation toggle; no interaction, full CIA impact from kernel memory corruption, consistent with the 7.8 baseline.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
HIGH
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

6
Analysis Generated
Jul 24, 2026 - 02:11 vuln.today
Patch released
Apr 27, 2026 - 18:32 nvd
Patch available
CVSS changed
Apr 27, 2026 - 15:22 NVD
7.8 (HIGH)
Patch available
Apr 25, 2026 - 10:16 EUVD
EUVD ID Assigned
Apr 25, 2026 - 09:00 euvd
EUVD-2026-25650
CVE Published
Apr 25, 2026 - 08:47 nvd
HIGH 7.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

batman-adv: avoid OGM aggregation when skb tailroom is insufficient

When OGM aggregation state is toggled at runtime, an existing forwarded packet may have been allocated with only packet_len bytes, while a later packet can still be selected for aggregation. Appending in this case can hit skb_put overflow conditions.

Reject aggregation when the target skb tailroom cannot accommodate the new packet. The caller then falls back to creating a new forward packet instead of appending.

AnalysisAI

Local privilege escalation and memory corruption in the Linux kernel's batman-adv mesh networking module allows a low-privileged attacker to trigger an skb_put buffer overflow by exploiting a race in OGM (Originator Message) aggregation. When aggregation is toggled at runtime, a forwarded packet allocated with only packet_len bytes can later be selected for aggregation, causing an append past the socket buffer's tailroom. CVSS 7.8 (High); EPSS is very low at 0.02% (7th percentile) and there is no public exploit identified at time of analysis and no CISA KEV listing.

Technical ContextAI

batman-adv (Better Approach To Mobile Ad-hoc Networking, advanced) is an in-kernel Layer 2 mesh routing protocol that periodically broadcasts Originator Messages (OGMs) to advertise link state. To reduce airtime, batman-adv aggregates multiple OGMs into a single skb (socket buffer) before forwarding. The defect is a classic buffer overflow (CWE-787/CWE-120 class, 'Buffer Overflow' per tags): a forward packet skb may be allocated sized to exactly packet_len with no spare tailroom, yet a subsequent code path still selects it as an aggregation target and calls skb_put() to append the new packet, writing beyond the allocated buffer. The fix rejects aggregation when the target skb tailroom cannot accommodate the additional packet, forcing the caller to allocate a fresh forward packet instead. Affected code lives in net/batman-adv; CPE data only identifies the generic cpe:2.3:a:linux:linux, so exact affected kernel builds must be derived from the stable-tree commits.

RemediationAI

Vendor-released patch: upgrade to a fixed Linux stable release - 5.10.253, 5.15.203, 6.1.167, 6.6.130, 6.12.78, 6.18.20, 6.19.10, or mainline 7.0 (or your distribution's equivalent). Ubuntu users should apply the kernel updates in USN-8567-1 (https://ubuntu.com/security/notices/USN-8567-1) and reboot; upstream fix commits are available at git.kernel.org/stable (e.g. https://git.kernel.org/stable/c/67176c96f325837b0bb3e9538ca2eba414f447d8 and the other listed stable commits). If patching must be deferred, the most effective compensating control is to avoid loading the batman-adv module on systems that do not need mesh networking (blacklist it via modprobe), which fully removes the vulnerable code path at the cost of losing batman-adv functionality; where batman-adv is required, avoid toggling OGM aggregation state at runtime, since the overflow is tied to that runtime state change. Refer to VulDB entry https://vuldb.com/vuln/359589 for cross-referenced advisory details.

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Share

CVE-2026-31683 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy