Look up another CVE · open CVE-2026-64088 in the interactive tracker
CVE-2026-64088
batman-adv: tt: fix negative tt_buff_len
Published 2026-07-19 (3 months ago) by the Linux kernel CNA. Subsystem net/batman-adv. Debian urgency: not yet assigned.
What to do, per Debian release
Debian's own status for CVE-2026-64088 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | fixed | 6.1.176-1 | Update the kernel and reboot. Fixed in 6.1.176-1. A running kernel keeps the old code until the machine restarts. |
| Debian 13trixie | fixed | 6.12.94-1 | Update the kernel and reboot. Fixed in 6.12.94-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 7.0.12-1 | Update the kernel and reboot. Fixed in 7.0.12-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.0.12-1 | Update the kernel and reboot. Fixed in 7.0.12-1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
batadv_orig_node::tt_buff_len was declared as s16, but the field is never intended to hold a negative value. When a value greater than 32767 is assigned, it wraps to a negative signed integer. In batadv_send_other_tt_response(), tt_buff_len is temporarily widened to s32. The incorrectly negative s16 value propagates into the s32, causing batadv_tt_prepare_tvlv_global_data() to allocate a full sized buffer but populates only a small portion of it with the collected changeset. All remaining bits are kept uninitialized. Using an u16 avoids this type confusion and ensures that no (negative) sign extension is performed in batadv_send_other_tt_response().
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
net/batman-adv/types.h
- What this is
- BATMAN ADVANCEDMAINTAINERS section matched on net/batman-adv/ · b.a.t.m.a.n@lists.open-mesh.org · Maintained
Show whether Debian builds this, per release
Not established. This site could not find the build rule for the affected file in the kernel trees Debian ships, so it has no answer about whether Debian compiles this code. Read that as unknown, never as absent.
- bookworm, trixie, forky, sid?
- ?
- not established - no Makefile entry for the affected file
Where a release above reads "not established", no build rule for the affected file was found in that release's kernel tree. That is a gap in this lookup, not a finding that the code is absent.
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS
Signals
- Published
- 2026-07-19 (3 months ago)source
- CVSS
- 8.8 high
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- adjacent network (AV:A)source
- EPSS
- 0.28%, higher than 19.3% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- not yet assignedsource
- Subsystem
- net/batman-adv
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 3.1 | 5.10.258 | 4c4c2f340f4c |
| 3.1 | 5.15.209 | 33e5ede7ce6d |
| 3.1 | 6.1.175 | 3c96dff00998 |
| 3.1 | 6.6.142 | 32edd2a28e11 |
| 3.1 | 6.12.92 | 4dab98961426 |
| 3.1 | 6.18.34 | 730de8733dd9 |
| 3.1 | 7.0.11 | ed28ead3420c |
| 3.1 | 7.1 | b64963a2ceeb |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:AAttack vector, adjacent network
- Batman-adv processes attacker-controlled translation-table TVLV traffic from mesh peers over WiFi/Ethernet L2; exploitation requires the attacker to be on the same wireless or LAN segment as the victim mesh node, matching the Adjacent definition for WiFi/L2 mesh protocols.
- AC:LAttack complexity, low
- An adjacent mesh attacker can send unauthenticated TT_REQUEST/TT_RESPONSE/OGM TVLV packets to populate `tt_buff_len` and then trigger `batadv_send_other_tt_response()` without depending on victim-controlled timing or memory layout.
- PR:NPrivileges required, none
- The vulnerable path is reached from pre-authentication mesh control-plane packet handling (`batadv_recv_unicast_tvlv` → `batadv_tt_tvlv_unicast_handler_v1`); no Linux credentials or capabilities are required on the victim host beyond having an active batman-adv mesh interface.
- UI:NUser interaction, none
- Exploitation requires only crafted mesh protocol packets from an adjacent attacker; no victim user action (opening files, clicking links, etc.) is needed at attack time.
- S:UScope, unchanged
- Impact is confined to kernel memory disclosure/corruption and potential local privilege escalation within the same kernel security authority; it does not cross VM, container, or IOMMU boundaries.
- C:HConfidentiality impact, high
- Sign-extended negative `tt_buff_len` causes `batadv_tt_prepare_tvlv_global_data()` to allocate a large buffer but only partially fill it, leaving the remainder uninitialized and transmitted to the requester in the TT_RESPONSE via `batadv_tvlv_unicast_send()`.
- I:HIntegrity impact, high
- The same type confusion passes a negative `s16` length to `memcpy()`, which promotes to a very large `size_t` and can cause out-of-bounds reads/writes from the undersized `tt_buff` allocation, enabling heap memory corruption.
- A:HAvailability impact, high
- The malformed `memcpy()` and associated heap corruption can trigger kernel oops/panic on the responding mesh node, and the bug class inherently threatens system availability even when not fully weaponized.