Integer Overflow in batman-adv Leading to Buffer Handling Issue

Executive Summary

This is a type confusion vulnerability in the Linux kernel's batman-adv module. It occurs when batadv_orig_node::tt_buff_len, declared as a signed 16-bit integer, wraps to a negative value when assigned a value over 32767. This negative value then propagates incorrectly when widened to a 32-bit integer in batadv_send_other_tt_response(), causing an undersized buffer to be allocated while the function attempts to populate a full-sized buffer with uninitialized data.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability is specific to the Linux kernel's batman-adv module and involves incorrect handling of tt_buff_len. Detection requires checking kernel logs for batman-adv related errors or examining the module's behavior during network operations. No direct commands are provided in the context to detect this issue.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability could allow an attacker to cause a denial of service or potentially execute arbitrary code by exploiting the buffer overflow resulting from the incorrect buffer size calculation. Systems running vulnerable versions of the Linux kernel with batman-adv enabled may be affected.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA as it is a low-level kernel memory handling issue in the batman-adv protocol. It could potentially lead to information exposure if uninitialized memory is leaked, but no evidence suggests direct regulatory impact.

Useful 0 Not Useful 0

Mitigation Strategies

Update the Linux kernel to a version that includes the fix for this vulnerability. The issue is resolved by ensuring batadv_orig_node::tt_buff_len is declared as u16 instead of s16 to prevent negative values. Check your distribution's security updates or kernel patches for CVE-2026-64088.

Useful 0 Not Useful 0