Skip to main content

Linux Kernel EUVDEUVD-2026-38704

| CVE-2026-52934 HIGH
2026-06-24 Linux GHSA-w473-pp3w-rqc2
Information Disclosure Linux Red Hat Suse
8.8
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
8.8 HIGH
AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
5.7 MEDIUM

Triggering requires >64KB of attacker-influenceable TVLV container state on a mesh-enabled node, so AC:H and PR:H; an out-of-bounds write impacts integrity/availability (I:H/A:H), not confidentiality (C:N).

3.1 AV:A/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:H
4.0 AV:A/AC:H/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Adjacent
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jun 28, 2026 - 08:27 vuln.today
CVSS changed
Jun 28, 2026 - 08:22 NVD
8.8 (HIGH)
Patch available
Jun 24, 2026 - 09:16 EUVD
CVE Published
Jun 24, 2026 - 07:14 cve.org
UNKNOWN (no severity yet)
CVE Published
Jun 24, 2026 - 07:14 cve.org
HIGH 8.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

batman-adv: tvlv: reject oversized TVLV packets

batadv_tvlv_container_ogm_append() builds a TVLV packet section from the tvlv.container_list. The total size of this section is computed by batadv_tvlv_container_list_size(), which sums the sizes of all registered containers.

The return type and accumulator in batadv_tvlv_container_list_size() were u16. If the accumulated size exceeds U16_MAX, the value wraps around, causing the subsequent allocation in batadv_tvlv_container_ogm_append() to be undersized. The memcpy-style copy that follows would then write beyond the end of the allocated buffer, corrupting kernel memory.

Fix this by widening the return type of batadv_tvlv_container_list_size() to size_t. In batadv_tvlv_container_ogm_append(), check the computed length against U16_MAX before proceeding, and bail out as if the allocation had failed when the limit is exceeded.

AnalysisAI

Kernel heap memory corruption affects the batman-adv (B.A.T.M.A.N. Advanced) mesh routing subsystem of the Linux kernel, where a u16 accumulator in batadv_tvlv_container_list_size() can wrap around when the total size of registered TVLV containers exceeds 65535 bytes, leading to an undersized allocation and a subsequent out-of-bounds memcpy write in batadv_tvlv_container_ogm_append(). An attacker positioned on the mesh able to drive TVLV container accumulation past U16_MAX can corrupt adjacent kernel memory, risking denial of service or potential code execution. This is no public exploit identified at time of analysis, EPSS exploitation probability is low (0.16%), and it is not listed in CISA KEV.

Technical ContextAI

batman-adv is an in-kernel Layer-2 mesh networking protocol that distributes routing metadata via OGM (Originator Message) broadcasts; TVLV (Type-Version-Length-Value) containers are the extensible payload sections appended to these OGMs. The flaw is rooted in an integer overflow / truncation (CWE-190) that feeds an undersized heap allocation and an out-of-bounds write (CWE-787): batadv_tvlv_container_list_size() summed all registered container sizes into a 16-bit accumulator, so once the cumulative size exceeded U16_MAX the value wrapped, the allocation in batadv_tvlv_container_ogm_append() was sized to the truncated value, and the copy of the full container list overran the buffer. The CPE data identifies the affected product generically as cpe:2.3:a:linux:linux, i.e. the mainline Linux kernel, but the vulnerable code path only exists when the batman-adv module is built and an active mesh interface is configured. The fix widens the return/accumulator type to size_t and explicitly checks the computed length against U16_MAX, bailing out as an allocation failure when the limit is exceeded.

RemediationAI

Vendor-released patch: update to a fixed stable kernel - 5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.93, 6.18.34, 7.0.11, or 7.1 (or later within each series), which widen batadv_tvlv_container_list_size() to size_t and add the U16_MAX guard. The corresponding upstream commits are published at git.kernel.org/stable (e.g. https://git.kernel.org/stable/c/c02aa6c0c9d1bea9bb75dea362b75ad225137bae); cross-reference your distribution's kernel update advisory for the exact backported package version. If immediate patching is not possible, the most effective compensating control is to avoid loading the batman-adv module on hosts that do not require mesh networking (for example via a modprobe blacklist or by not bringing up bat0 interfaces), which fully removes the attack surface but disables mesh routing on that node; where mesh is required operationally, restrict the mesh L2 segment to trusted nodes and constrain which components may register TVLV containers, accepting that this limits but does not eliminate the accumulation path until the kernel is patched.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

EUVD-2026-38704 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy