CVE-2026-64091

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:NAttack vector, network

The bug is hit in `batadv_tt_prepare_tvlv_local_data()` when building TT TVLVs for OGM updates or TT_RESPONSE replies. A remote mesh peer can trigger the response path by sending unicast TVLV TT_REQUEST packets (`batadv_recv_unicast_tvlv` → `batadv_tt_tvlv_unicast_handler_v1` → `batadv_send_my_tt_response`) and can race the OGM commit path by flooding mesh traffic that registers new clients via `batadv_tt_local_add()`.

AC:LAttack complexity, low

The attacker controls both sides of the TOCTOU race by concurrently sending TT_REQUEST packets and traffic that adds TT entries to VLANs that were empty during the size calculation. No victim-specific memory layout or rare timing outside the attacker's control is required.

PR:NPrivileges required, none

Exploitation requires only participation in an active batman-adv mesh as an unauthenticated remote peer sending protocol packets. No local Linux credentials, capabilities, or netlink/rtnl admin rights on the victim host are needed.

UI:NUser interaction, none

The vulnerability is triggered entirely by attacker-sent mesh protocol packets and concurrent traffic processing; no victim user action such as mounting a filesystem or opening a file is required.

S:UScope, unchanged

The out-of-bounds write corrupts kernel heap memory within the same kernel security boundary. This is standard in-kernel memory corruption, not a cross-boundary escape such as VM guest-to-host or IOMMU bypass.

C:HConfidentiality impact, high

The TOCTOU causes undersized `kmalloc()` allocation followed by out-of-bounds writes of `batadv_tvlv_tt_vlan_data` structures (8 bytes each) and misplacement of the TT changes region, with subsequent `memcpy()` of change entries writing further past the buffer end. Heap corruption of this kind can be leveraged for arbitrary kernel memory disclosure.

I:HIntegrity impact, high

Writing VLAN headers and TT change records beyond the allocated buffer is a kernel heap buffer overflow. With heap grooming this class of corruption is exploitable for arbitrary kernel memory writes and potential privilege escalation.

A:HAvailability impact, high

Heap corruption from the out-of-bounds writes can cause immediate kernel oops/panic from corrupting adjacent slab objects or allocator metadata, and is independently a high availability impact even before successful exploitation.