Executive brief
A vulnerability was identified in the Linux kernel's 'batman-adv' mesh networking protocol. This component is used to manage communication between devices in a decentralized network. An attacker could potentially send specially crafted network packets that cause the system to miscalculate memory requirements, leading to a system crash or unauthorized memory access. This could disrupt network operations or allow for further exploitation of the affected device.
Technical details
An integer overflow exists in the batadv_tvlv_container_list_size() function within the batman-adv mesh networking implementation. The function used a 16-bit unsigned integer (u16) to accumulate the total size of registered TVLV containers. If the combined size exceeds 65,535 bytes, the value wraps around, leading to an undersized memory allocation in batadv_tvlv_container_ogm_append(). Subsequent memcpy operations then write beyond the allocated buffer, resulting in kernel heap corruption. This can be triggered via network-reachable vectors if an attacker can influence the registration or processing of TVLV containers. The fix involves widening the accumulator to size_t and implementing explicit bounds checking against U16_MAX.
Affected products
- Linux Linux Kernel ef26157747d4 to f50487e35663
Timeline
- 2026-05-29: patched: Initial fix authored by Sven Eckelmann
- 2026-06-24: disclosed: CVE published in NVD
References
- https://git.kernel.org/stable/c/13493b00dd1e05a705981e052158652ea23eb482
- https://git.kernel.org/stable/c/1595628a2f877d052eda18865ccf539392c47c04
- https://git.kernel.org/stable/c/6448a49344e87487b61bd88cb850cd694a0f576d
- https://git.kernel.org/stable/c/94a3d72cd9b21116d7c6d5bdc57c11401fc28557
- https://git.kernel.org/stable/c/94db72e9dac202e017ee3db22c59d17e4f3bf171
- https://git.kernel.org/stable/c/c02aa6c0c9d1bea9bb75dea362b75ad225137bae
- https://git.kernel.org/stable/c/ede47988ac5687793745b17c1634a496a2299919