Skip to main content

Linux Kernel CVE-2026-64088

| EUVDEUVD-2026-45773 HIGH
2026-07-19 Linux GHSA-r69h-9cf6-78mg
Information Disclosure Linux
8.8
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
8.8 HIGH
AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
6.5 MEDIUM

Adjacent mesh participation only (AV:A), no auth or interaction (PR:N/UI:N); impact is an uninitialized-memory leak, so C:H with I:N/A:N unlike the over-scored 8.8.

3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
SUSE
HIGH
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Adjacent
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jul 20, 2026 - 17:21 vuln.today
CVSS changed
Jul 20, 2026 - 15:22 NVD
8.8 (HIGH)
Patch available
Jul 19, 2026 - 17:03 EUVD
CVE Published
Jul 19, 2026 - 15:39 cve.org
UNKNOWN (no severity yet)
CVE Published
Jul 19, 2026 - 15:39 cve.org
HIGH 8.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

batman-adv: tt: fix negative tt_buff_len

batadv_orig_node::tt_buff_len was declared as s16, but the field is never intended to hold a negative value. When a value greater than 32767 is assigned, it wraps to a negative signed integer.

In batadv_send_other_tt_response(), tt_buff_len is temporarily widened to s32. The incorrectly negative s16 value propagates into the s32, causing batadv_tt_prepare_tvlv_global_data() to allocate a full sized buffer but populates only a small portion of it with the collected changeset. All remaining bits are kept uninitialized.

Using an u16 avoids this type confusion and ensures that no (negative) sign extension is performed in batadv_send_other_tt_response().

AnalysisAI

Uninitialized kernel-memory disclosure in the Linux kernel's batman-adv (B.A.T.M.A.N. advanced) mesh-routing module allows an adjacent mesh peer to receive leaked kernel heap contents inside translation-table (TT) response frames. The batadv_orig_node::tt_buff_len field was typed as s16 and wraps negative when a changeset exceeds 32767 bytes, so batadv_tt_prepare_tvlv_global_data() allocates a full-size buffer but populates only a small portion, transmitting the uninitialized remainder over the mesh. No public exploit identified at time of analysis and EPSS is low (0.18%, 8th percentile), consistent with a niche, non-default kernel feature rather than a broadly weaponized flaw.

Technical ContextAI

batman-adv is an in-kernel Layer-2 mesh-routing protocol (CONFIG_BATMAN_ADV) that distributes a 'translation table' (TT) mapping client MAC addresses to originator nodes. The bug is a signed-integer type-confusion / uninitialized-memory-use issue (aligns with CWE-195 incorrect signedness and CWE-908/CWE-457 use of uninitialized resource; the feed lists CWE as N/A). tt_buff_len tracks the length of the serialized TT changeset buffer on an originator node; declared as signed s16 it silently wraps negative past 32767 bytes. In batadv_send_other_tt_response() the value is widened to s32, and the negative s16 sign-extends, so batadv_tt_prepare_tvlv_global_data() sizes the TLV allocation from the intended large length while only the small collected changeset is populated, leaving the tail as uninitialized kernel memory that is emitted in the TT response. CPE data scopes this to cpe:2.3:a:linux:linux (mainline kernel); the vulnerable path exists only where the batman-adv module is built and loaded.

RemediationAI

Apply the vendor-released kernel patch by upgrading to the fixed build for your branch: 5.10.258, 5.15.209, 6.1.175, 6.6.142, 6.12.92, 6.18.34, or mainline 7.1 (and later); the fix changes tt_buff_len from s16 to u16 to remove the sign extension. Distribution users should take the corresponding stable-kernel update; commits are at https://git.kernel.org/stable/c/4c4c2f340f4c27373bfcac8dc5032ce7bb474e47 and the sibling hashes listed above. Where immediate patching is not possible, the most effective compensating control is to unload and blacklist the batman-adv module (rmmod batman_adv, then blacklist it) on hosts that do not require mesh routing - this fully removes the attack surface, with the side effect of disabling B.A.T.M.A.N. mesh connectivity. For nodes that must run the mesh, restrict membership to trusted/authenticated peers and segment the mesh L2 domain so untrusted devices cannot join, since only adjacent mesh participants can receive the leaked TT responses.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2026-64088 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy