CVE-2026-64090
Received Received - Intake

batman-adv: Avoid Empty VLAN Responses in TT

Publication date: 2026-07-19

Last updated on: 2026-07-19

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: batman-adv: tt: avoid empty VLAN responses The commit 16116dac2339 ("batman-adv: prevent TT request storms by not sending inconsistent TT TLVLs") added checks to the local (direct) TT response code. But the response can also be done indirectly by another node using the global TT state. To avoid such inconsistency states reported in the original fix, also avoid sending empty VLANs for replies from the global TT state.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-19
Last Modified
2026-07-19
Generated
2026-07-20
AI Q&A
2026-07-19
EPSS Evaluated
N/A
NVD
CVE-2026-64090
EUVD
EUVD-2026-45775

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves the batman-adv protocol, which is used for mesh networking. The issue occurs when handling Translation Table (TT) responses. The fix prevents sending empty VLAN responses when replying from the global TT state, which could otherwise lead to inconsistency in network state reporting.

Detection Guidance

This vulnerability is specific to the Linux kernel's batman-adv module and relates to TT (Translation Table) responses. Detection requires checking kernel logs for TT-related errors or inconsistencies in batman-adv operations. Commands like dmesg | grep batman-adv or journalctl -u batman-adv may reveal issues. Ensure the kernel version includes the fix commit 16116dac2339.

Impact Analysis

If exploited, this vulnerability could disrupt mesh network operations by causing inconsistent state reporting. This might lead to unreliable network connectivity or routing issues in systems using batman-adv for communication.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it pertains to a specific Linux kernel networking component (batman-adv) and does not involve data privacy, security controls, or protected health information handling.

Mitigation Strategies

Update the Linux kernel to the latest patched version to resolve the batman-adv TT response vulnerability. Monitor network traffic for inconsistent VLAN responses in batman-adv TT messages.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64090. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart