Executive brief
The batman-adv module in the Linux kernel failed to validate multicast packet header offsets before using them to access network buffer memory. An attacker could craft a malicious multicast packet with an oversized trailer that causes the kernel to read memory beyond the packet's bounds, potentially leaking sensitive information or causing a system crash.
Technical details
The vulnerability exists in batman-adv's batadv_tvlv_call_handler() function, which processes multicast TVLV (Type-Value-Length-Value) structures from received packets. The function sets 16-bit sk_buff header offsets without validating whether the calculated offset fits in the 16-bit field range. If a TVLV end offset exceeds U16_MAX, the offset gets truncated, causing the transport header to precede the network header. This results in skb_network_header_len() returning an incorrectly large value, leading batadv_mcast_forw_packet() to access memory beyond the skb data bounds. The fix introduces skb_set_transport_header_careful(), which validates offsets before assignment and rejects unrepresentable TVLVs. An attacker must craft a malicious multicast packet reachable over the network; no authentication is required.
Affected products
- Linux Linux kernel Multiple versions prior to the patch (introduced in commit 07afe1ba288c; patched in 2026-09-02)
Timeline
- 2026-09-04: disclosed
- 2026-09-02: patched