Junglewise Threat Intelligence

CVE-2026-46198: Linux Kernel integer overflow in batman-adv OGM processing

CVE-2026-46198 · Severity: info · Published 2026-05-28

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability was identified in the Linux kernel's batman-adv module, which is used for managing mobile ad-hoc networks. An error in how the system tracks data positions could allow a specially crafted network packet to cause the system to read memory outside of the intended boundaries. This could potentially lead to system instability or the exposure of sensitive information from the kernel's memory.

Technical details

An integer overflow exists in the batadv_iv_ogm_send_to_if function within net/batman-adv/bat_iv_ogm.c. The vulnerability stems from a type mismatch where a size check is performed using a 32-bit integer (int) in batadv_iv_ogm_aggr_packet, but the buff_pos variable is stored as a 16-bit signed integer (s16). If a packet is large enough to overflow the s16 range, it can lead to an out-of-bounds read when accessing the packet buffer. This can be triggered by processing malicious OGM aggregation packets. The fix involves changing the buff_pos variable type to int to match the size check logic.

Affected products

  • Linux Linux Kernel All versions prior to the May 2026 patches

Timeline

  • 2026-04-22: other: Vulnerability reported by Lyes Bourennani
  • 2026-05-02: patched: Initial patch committed to stable tree
  • 2026-05-28: advisory: CVE-2026-46198 published by NVD

References