CVE-2026-64088 (GCVE-0-2026-64088)
Vulnerability from cvelistv5
Published
2026-07-19 15:39
Modified
2026-08-05 12:39
Severity ?
8.8 (High) - CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: batman-adv: tt: fix negative tt_buff_len batadv_orig_node::tt_buff_len was declared as s16, but the field is never intended to hold a negative value. When a value greater than 32767 is assigned, it wraps to a negative signed integer. In batadv_send_other_tt_response(), tt_buff_len is temporarily widened to s32. The incorrectly negative s16 value propagates into the s32, causing batadv_tt_prepare_tvlv_global_data() to allocate a full sized buffer but populates only a small portion of it with the collected changeset. All remaining bits are kept uninitialized. Using an u16 avoids this type confusion and ensures that no (negative) sign extension is performed in batadv_send_other_tt_response().
References
Impacted products
Vendor Product Version
Linux Linux Version: a73105b8d4c765d9ebfb664d0a66802127d8e4c7
Version: a73105b8d4c765d9ebfb664d0a66802127d8e4c7
Version: a73105b8d4c765d9ebfb664d0a66802127d8e4c7
Version: a73105b8d4c765d9ebfb664d0a66802127d8e4c7
Version: a73105b8d4c765d9ebfb664d0a66802127d8e4c7
Version: a73105b8d4c765d9ebfb664d0a66802127d8e4c7
Version: a73105b8d4c765d9ebfb664d0a66802127d8e4c7
Version: a73105b8d4c765d9ebfb664d0a66802127d8e4c7
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/batman-adv/types.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "4c4c2f340f4c27373bfcac8dc5032ce7bb474e47",
              "status": "affected",
              "version": "a73105b8d4c765d9ebfb664d0a66802127d8e4c7",
              "versionType": "git"
            },
            {
              "lessThan": "33e5ede7ce6d92e531920d4bbd6d3e18ef1c6430",
              "status": "affected",
              "version": "a73105b8d4c765d9ebfb664d0a66802127d8e4c7",
              "versionType": "git"
            },
            {
              "lessThan": "3c96dff00998314983b68a3e7caac07a66ebe496",
              "status": "affected",
              "version": "a73105b8d4c765d9ebfb664d0a66802127d8e4c7",
              "versionType": "git"
            },
            {
              "lessThan": "32edd2a28e112064020a2f319a8cb8a9e5a09767",
              "status": "affected",
              "version": "a73105b8d4c765d9ebfb664d0a66802127d8e4c7",
              "versionType": "git"
            },
            {
              "lessThan": "4dab98961426d0cf6a1599cda6950b7596ca2fcd",
              "status": "affected",
              "version": "a73105b8d4c765d9ebfb664d0a66802127d8e4c7",
              "versionType": "git"
            },
            {
              "lessThan": "730de8733dd90f70d7580a9b329b971f8e1474a2",
              "status": "affected",
              "version": "a73105b8d4c765d9ebfb664d0a66802127d8e4c7",
              "versionType": "git"
            },
            {
              "lessThan": "ed28ead3420c373a7928622f114bc6168075d1e1",
              "status": "affected",
              "version": "a73105b8d4c765d9ebfb664d0a66802127d8e4c7",
              "versionType": "git"
            },
            {
              "lessThan": "b64963a2ceeb7529310b6cf253a1e540784422f4",
              "status": "affected",
              "version": "a73105b8d4c765d9ebfb664d0a66802127d8e4c7",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/batman-adv/types.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.1"
            },
            {
              "lessThan": "3.1",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.258",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.209",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.175",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.142",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.92",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.34",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.258",
                  "versionStartIncluding": "3.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.209",
                  "versionStartIncluding": "3.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.175",
                  "versionStartIncluding": "3.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.142",
                  "versionStartIncluding": "3.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.92",
                  "versionStartIncluding": "3.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.34",
                  "versionStartIncluding": "3.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.11",
                  "versionStartIncluding": "3.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "3.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbatman-adv: tt: fix negative tt_buff_len\n\nbatadv_orig_node::tt_buff_len was declared as s16, but the field is never\nintended to hold a negative value. When a value greater than 32767 is\nassigned, it wraps to a negative signed integer.\n\nIn batadv_send_other_tt_response(), tt_buff_len is temporarily widened to\ns32. The incorrectly negative s16 value propagates into the s32, causing\nbatadv_tt_prepare_tvlv_global_data() to allocate a full sized buffer but\npopulates only a small portion of it with the collected changeset. All\nremaining bits are kept uninitialized.\n\nUsing an u16 avoids this type confusion and ensures that no (negative) sign\nextension is performed in batadv_send_other_tt_response()."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - Batman-adv processes attacker-controlled translation-table TVLV traffic from mesh peers over WiFi/Ethernet L2; exploitation requires the attacker to be on the same wireless or LAN segment as the victim mesh node, matching the Adjacent definition for WiFi/L2 mesh protocols.\nAC:L - An adjacent mesh attacker can send unauthenticated TT_REQUEST/TT_RESPONSE/OGM TVLV packets to populate `tt_buff_len` and then trigger `batadv_send_other_tt_response()` without depending on victim-controlled timing or memory layout.\nPR:N - The vulnerable path is reached from pre-authentication mesh control-plane packet handling (`batadv_recv_unicast_tvlv` \u2192 `batadv_tt_tvlv_unicast_handler_v1`); no Linux credentials or capabilities are required on the victim host beyond having an active batman-adv mesh interface.\nUI:N - Exploitation requires only crafted mesh protocol packets from an adjacent attacker; no victim user action (opening files, clicking links, etc.) is needed at attack time.\nS:U - Impact is confined to kernel memory disclosure/corruption and potential local privilege escalation within the same kernel security authority; it does not cross VM, container, or IOMMU boundaries.\nC:H - Sign-extended negative `tt_buff_len` causes `batadv_tt_prepare_tvlv_global_data()` to allocate a large buffer but only partially fill it, leaving the remainder uninitialized and transmitted to the requester in the TT_RESPONSE via `batadv_tvlv_unicast_send()`.\nI:H - The same type confusion passes a negative `s16` length to `memcpy()`, which promotes to a very large `size_t` and can cause out-of-bounds reads/writes from the undersized `tt_buff` allocation, enabling heap memory corruption.\nA:H - The malformed `memcpy()` and associated heap corruption can trigger kernel oops/panic on the responding mesh node, and the bug class inherently threatens system availability even when not fully weaponized."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:39:05.060Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/4c4c2f340f4c27373bfcac8dc5032ce7bb474e47"
        },
        {
          "url": "https://git.kernel.org/stable/c/33e5ede7ce6d92e531920d4bbd6d3e18ef1c6430"
        },
        {
          "url": "https://git.kernel.org/stable/c/3c96dff00998314983b68a3e7caac07a66ebe496"
        },
        {
          "url": "https://git.kernel.org/stable/c/32edd2a28e112064020a2f319a8cb8a9e5a09767"
        },
        {
          "url": "https://git.kernel.org/stable/c/4dab98961426d0cf6a1599cda6950b7596ca2fcd"
        },
        {
          "url": "https://git.kernel.org/stable/c/730de8733dd90f70d7580a9b329b971f8e1474a2"
        },
        {
          "url": "https://git.kernel.org/stable/c/ed28ead3420c373a7928622f114bc6168075d1e1"
        },
        {
          "url": "https://git.kernel.org/stable/c/b64963a2ceeb7529310b6cf253a1e540784422f4"
        }
      ],
      "title": "batman-adv: tt: fix negative tt_buff_len",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64088",
    "datePublished": "2026-07-19T15:39:58.084Z",
    "dateReserved": "2026-07-19T07:54:57.032Z",
    "dateUpdated": "2026-08-05T12:39:05.060Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.