batman-adv: tt: fix negative last_changeset_len

MITRE NVD CVE.ORG JSON API Print: PDF PDF

Summary

CVECVE-2026-64089
StatePUBLISHED
AssignerLinux
Source PriorityCVE Program / NVD first with legacy fallback
Published2026-07-19 16:17:49 UTC
Updated2026-07-20 15:17:08 UTC
DescriptionIn the Linux kernel, the following vulnerability has been resolved: batman-adv: tt: fix negative last_changeset_len batadv_piv_tt::last_changeset_len len was declared as s16, but the field is never intended to hold a negative value. When a value greater than 32767 is assigned, it wraps to a negative signed integer. In batadv_send_my_tt_response(), last_changeset_len is temporarily widened to s32. The incorrectly negative s16 value propagates into the s32, causing batadv_tt_prepare_tvlv_local_data() to allocate a full sized buffer but populates only a small portion of it with the collected changeset. All remaining bits are kept uninitialized. Using an u16 avoids this type confusion and ensures that no (negative) sign extension is performed in batadv_send_my_tt_response().

Risk And Classification

Primary CVSS: v3.1 9.8 CRITICAL from 416baaa9-dc9f-4396-8d5f-8c081fb06d67

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.001840000 probability, percentile 0.082510000 (date 2026-07-20)

VersionSourceTypeScoreSeverityVector
3.1416baaa9-dc9f-4396-8d5f-8c081fb06d67Secondary9.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
3.1CNADECLARED9.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v3.1 Breakdown

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA Linux Linux affected a73105b8d4c765d9ebfb664d0a66802127d8e4c7 6314089acf0ddf64376fdc0b1420695504c73f52 git Not specified
CNA Linux Linux affected a73105b8d4c765d9ebfb664d0a66802127d8e4c7 55dc41fe8821e9a849e147255ad572bc933a9d15 git Not specified
CNA Linux Linux affected a73105b8d4c765d9ebfb664d0a66802127d8e4c7 c424e8519ac78eac5d9f4eecf06208a0d619ec14 git Not specified
CNA Linux Linux affected a73105b8d4c765d9ebfb664d0a66802127d8e4c7 22d59c72f4a47ffec121d0610f70d0d70c3c11c8 git Not specified
CNA Linux Linux affected a73105b8d4c765d9ebfb664d0a66802127d8e4c7 eb235472b52ef36981c5aad330485eaf2382c53b git Not specified
CNA Linux Linux affected a73105b8d4c765d9ebfb664d0a66802127d8e4c7 179eb62506a02d00370bd6478898cb632e10986c git Not specified
CNA Linux Linux affected a73105b8d4c765d9ebfb664d0a66802127d8e4c7 d29abf70c665730e249d2ec8e1402095ae26bcee git Not specified
CNA Linux Linux affected a73105b8d4c765d9ebfb664d0a66802127d8e4c7 fc92cdfcb295cefa4344d71a527d61b638b7bfc4 git Not specified
CNA Linux Linux affected 3.1 Not specified
CNA Linux Linux unaffected 3.1 semver Not specified
CNA Linux Linux unaffected 5.10.258 5.10.* semver Not specified
CNA Linux Linux unaffected 5.15.209 5.15.* semver Not specified
CNA Linux Linux unaffected 6.1.175 6.1.* semver Not specified
CNA Linux Linux unaffected 6.6.142 6.6.* semver Not specified
CNA Linux Linux unaffected 6.12.92 6.12.* semver Not specified
CNA Linux Linux unaffected 6.18.34 6.18.* semver Not specified
CNA Linux Linux unaffected 7.0.11 7.0.* semver Not specified
CNA Linux Linux unaffected 7.1 * original_commit_for_fix Not specified

References

ReferenceSourceLinkTags
git.kernel.org/stable/c/eb235472b52ef36981c5aad330485eaf2382c53b 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/55dc41fe8821e9a849e147255ad572bc933a9d15 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/179eb62506a02d00370bd6478898cb632e10986c 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/22d59c72f4a47ffec121d0610f70d0d70c3c11c8 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/6314089acf0ddf64376fdc0b1420695504c73f52 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/fc92cdfcb295cefa4344d71a527d61b638b7bfc4 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/c424e8519ac78eac5d9f4eecf06208a0d619ec14 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/d29abf70c665730e249d2ec8e1402095ae26bcee 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report