Executive brief
A vulnerability was identified in the Linux kernel's batman-adv mesh networking component. This component is used to manage communication between devices in a decentralized network. An error in how the system tracks network changes could lead to memory being improperly handled, potentially allowing sensitive information to be leaked or causing network instability.
Technical details
A vulnerability exists in the batman-adv module of the Linux kernel due to an incorrect type declaration of 'last_changeset_len' as a signed 16-bit integer (s16). When this value exceeds 32767, it wraps to a negative value. In 'batadv_send_my_tt_response()', this value is widened to a signed 32-bit integer (s32), causing 'batadv_tt_prepare_tvlv_local_data()' to allocate a buffer that is only partially populated. This results in the transmission of uninitialized kernel memory over the network. The fix involves changing the variable type to an unsigned 16-bit integer (u16) to prevent negative sign extension.
Affected products
- Linux Linux Kernel 3.1 to 6.14
Timeline
- 2026-05-02: other: Patch authored
- 2026-06-01: patched: Patch committed to stable tree
- 2026-07-19: disclosed: CVE published
References
- https://git.kernel.org/stable/c/179eb62506a02d00370bd6478898cb632e10986c
- https://git.kernel.org/stable/c/22d59c72f4a47ffec121d0610f70d0d70c3c11c8
- https://git.kernel.org/stable/c/55dc41fe8821e9a849e147255ad572bc933a9d15
- https://git.kernel.org/stable/c/6314089acf0ddf64376fdc0b1420695504c73f52
- https://git.kernel.org/stable/c/c424e8519ac78eac5d9f4eecf06208a0d619ec14
- https://git.kernel.org/stable/c/d29abf70c665730e249d2ec8e1402095ae26bcee
- https://git.kernel.org/stable/c/eb235472b52ef36981c5aad330485eaf2382c53b