CVE-2026-64089
Received Received - Intake

batman-adv Type Confusion in TT Changeset Handling

Publication date: 2026-07-19

Last updated on: 2026-07-19

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: batman-adv: tt: fix negative last_changeset_len batadv_piv_tt::last_changeset_len len was declared as s16, but the field is never intended to hold a negative value. When a value greater than 32767 is assigned, it wraps to a negative signed integer. In batadv_send_my_tt_response(), last_changeset_len is temporarily widened to s32. The incorrectly negative s16 value propagates into the s32, causing batadv_tt_prepare_tvlv_local_data() to allocate a full sized buffer but populates only a small portion of it with the collected changeset. All remaining bits are kept uninitialized. Using an u16 avoids this type confusion and ensures that no (negative) sign extension is performed in batadv_send_my_tt_response().

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-19
Last Modified
2026-07-19
Generated
2026-07-20
AI Q&A
2026-07-19
EPSS Evaluated
N/A
NVD
CVE-2026-64089
EUVD
EUVD-2026-45774

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a signed integer overflow in the batman-adv protocol. The field last_changeset_len was incorrectly declared as a signed 16-bit integer (s16), which can lead to negative values when large positive values are assigned. This negative value then propagates through the code, causing a buffer allocation mismatch where only a small portion of a larger buffer is populated, leaving the rest uninitialized.

Detection Guidance

This vulnerability is specific to the Linux kernel's batman-adv module and may not have direct detection commands. Check kernel logs for batman-adv related errors or warnings. Use 'dmesg | grep batman-adv' to inspect kernel messages for anomalies.

Impact Analysis

This vulnerability could lead to memory corruption or unexpected behavior in systems running the affected Linux kernel with batman-adv enabled. Attackers might exploit this to cause crashes, data leaks, or privilege escalation if they can trigger the overflow condition.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA. It is a type confusion issue in the Linux kernel's batman-adv module that could lead to buffer allocation and data integrity problems, but no evidence suggests it impacts data protection or privacy requirements.

Mitigation Strategies

Update the Linux kernel to a patched version that includes the fix for batman-adv. Monitor kernel updates from your distribution vendor. If using batman-adv as a module, ensure it is recompiled with the latest kernel headers.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64089. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart