Skip to main content

Linux Kernel batman-adv CVE-2026-64089

| EUVDEUVD-2026-45774 CRITICAL
2026-07-19 Linux GHSA-7jfx-377j-9v79
Information Disclosure Linux
Critical
Disputed · 9.8 Vendor: Linux
Share

Severity by source

Sources disagree (Medium–Critical)
Vendor (Linux) PRIMARY
9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
3.1 LOW

Adjacent mesh peer (AV:A), requires a >32767-byte changeset to trigger the wrap (AC:H), no host auth (PR:N); impact is an uninitialized-memory confidentiality leak only (C:L, I:N, A:N).

3.1 AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
4.0 AV:A/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
SUSE
6.5 MEDIUM
AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Linux

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jul 20, 2026 - 17:21 vuln.today
CVSS changed
Jul 20, 2026 - 15:22 NVD
9.8 (CRITICAL)
Patch available
Jul 19, 2026 - 17:03 EUVD
CVE Published
Jul 19, 2026 - 15:39 cve.org
UNKNOWN (no severity yet)
CVE Published
Jul 19, 2026 - 15:39 cve.org
CRITICAL 9.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

batman-adv: tt: fix negative last_changeset_len

batadv_piv_tt::last_changeset_len len was declared as s16, but the field is never intended to hold a negative value. When a value greater than 32767 is assigned, it wraps to a negative signed integer.

In batadv_send_my_tt_response(), last_changeset_len is temporarily widened to s32. The incorrectly negative s16 value propagates into the s32, causing batadv_tt_prepare_tvlv_local_data() to allocate a full sized buffer but populates only a small portion of it with the collected changeset. All remaining bits are kept uninitialized.

Using an u16 avoids this type confusion and ensures that no (negative) sign extension is performed in batadv_send_my_tt_response().

AnalysisAI

Kernel memory disclosure in the Linux kernel's batman-adv (B.A.T.M.A.N. Advanced) mesh networking module arises from an integer wraparound in the translation-table (TT) code, where last_changeset_len was a signed s16 that wraps negative once a changeset exceeds 32767 bytes; batadv_send_my_tt_response() then sign-extends that value and batadv_tt_prepare_tvlv_local_data() allocates a full-sized TVLV buffer while filling only a small part, emitting the uninitialized remainder onto the mesh. A remote mesh peer can thereby receive stale kernel heap contents in TT response frames, tagged by the source as Information Disclosure. There is no public exploit identified at time of analysis, EPSS is low (0.18%), and the issue is not in CISA KEV; a vendor patch is available.

Technical ContextAI

batman-adv is the in-kernel implementation of the B.A.T.M.A.N. Advanced layer-2 mesh routing protocol, which propagates client MAC addresses between mesh nodes via a Translation Table (TT) carried in TVLV (Type-Length-Value-Length) containers. The root cause is a type-confusion / integer-signedness bug: batadv_priv_tt::last_changeset_len was declared s16, but the accumulated changeset length is an unsigned quantity that can exceed 32767; when it does, the value wraps to negative. That negative value is then widened to s32 in batadv_send_my_tt_response(), and the resulting sign-extended figure drives batadv_tt_prepare_tvlv_local_data() to allocate a large buffer that is only partially populated. Although the source lists CWE as N/A, this maps to CWE-190 (integer overflow/wraparound) leading to CWE-908/CWE-457 (use of uninitialized resource), producing an out-of-slab information leak. The fix changes the field to u16 so no negative sign extension occurs. Per the CPE (cpe:2.3:a:linux:linux), the affected product is the mainline Linux kernel, specifically builds with CONFIG_BATMAN_ADV enabled and the module in use.

RemediationAI

Vendor-released patch: update to a fixed stable kernel for your branch - 5.10.258, 5.15.209, 6.1.175, 6.6.142, 6.12.92, 6.18.34, or 7.0.11 (or later), which changes last_changeset_len from s16 to u16. The upstream fix is available as the kernel.org stable commits (e.g. https://git.kernel.org/stable/c/6314089acf0ddf64376fdc0b1420695504c73f52, https://git.kernel.org/stable/c/c424e8519ac78eac5d9f4eecf06208a0d619ec14); apply your distribution's corresponding kernel security update once released. If you cannot patch immediately and do not require mesh networking, unload and blacklist the module (rmmod batman_adv, then blacklist batman-adv in /etc/modprobe.d) - the trade-off is loss of all B.A.T.M.A.N. Advanced mesh routing on that host. Where the mesh is required, restrict mesh membership to trusted, authenticated nodes and segment the mesh L2 domain so untrusted devices cannot join and receive TT responses; this limits who can observe the leaked frames but does not fix the underlying uninitialized-memory disclosure.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2026-64089 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy