CVE-2026-64088 (GCVE-0-2026-64088)

Vulnerability from cvelistv5 – Published: 2026-07-19 15:39 – Updated: 2026-08-05 12:39
VLAI
Title
batman-adv: tt: fix negative tt_buff_len
Summary
In the Linux kernel, the following vulnerability has been resolved: batman-adv: tt: fix negative tt_buff_len batadv_orig_node::tt_buff_len was declared as s16, but the field is never intended to hold a negative value. When a value greater than 32767 is assigned, it wraps to a negative signed integer. In batadv_send_other_tt_response(), tt_buff_len is temporarily widened to s32. The incorrectly negative s16 value propagates into the s32, causing batadv_tt_prepare_tvlv_global_data() to allocate a full sized buffer but populates only a small portion of it with the collected changeset. All remaining bits are kept uninitialized. Using an u16 avoids this type confusion and ensures that no (negative) sign extension is performed in batadv_send_other_tt_response().
Severity
8.8 (High)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: a73105b8d4c765d9ebfb664d0a66802127d8e4c7 , < 4c4c2f340f4c27373bfcac8dc5032ce7bb474e47 (git)
Affected: a73105b8d4c765d9ebfb664d0a66802127d8e4c7 , < 33e5ede7ce6d92e531920d4bbd6d3e18ef1c6430 (git)
Affected: a73105b8d4c765d9ebfb664d0a66802127d8e4c7 , < 3c96dff00998314983b68a3e7caac07a66ebe496 (git)
Affected: a73105b8d4c765d9ebfb664d0a66802127d8e4c7 , < 32edd2a28e112064020a2f319a8cb8a9e5a09767 (git)
Affected: a73105b8d4c765d9ebfb664d0a66802127d8e4c7 , < 4dab98961426d0cf6a1599cda6950b7596ca2fcd (git)
Affected: a73105b8d4c765d9ebfb664d0a66802127d8e4c7 , < 730de8733dd90f70d7580a9b329b971f8e1474a2 (git)
Affected: a73105b8d4c765d9ebfb664d0a66802127d8e4c7 , < ed28ead3420c373a7928622f114bc6168075d1e1 (git)
Affected: a73105b8d4c765d9ebfb664d0a66802127d8e4c7 , < b64963a2ceeb7529310b6cf253a1e540784422f4 (git)
Create a notification for this product.
Linux Linux Affected: 3.1
Unaffected: 0 , < 3.1 (semver)
Unaffected: 5.10.258 , ≤ 5.10.* (semver)
Unaffected: 5.15.209 , ≤ 5.15.* (semver)
Unaffected: 6.1.175 , ≤ 6.1.* (semver)
Unaffected: 6.6.142 , ≤ 6.6.* (semver)
Unaffected: 6.12.92 , ≤ 6.12.* (semver)
Unaffected: 6.18.34 , ≤ 6.18.* (semver)
Unaffected: 7.0.11 , ≤ 7.0.* (semver)
Unaffected: 7.1 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/batman-adv/types.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "4c4c2f340f4c27373bfcac8dc5032ce7bb474e47",
              "status": "affected",
              "version": "a73105b8d4c765d9ebfb664d0a66802127d8e4c7",
              "versionType": "git"
            },
            {
              "lessThan": "33e5ede7ce6d92e531920d4bbd6d3e18ef1c6430",
              "status": "affected",
              "version": "a73105b8d4c765d9ebfb664d0a66802127d8e4c7",
              "versionType": "git"
            },
            {
              "lessThan": "3c96dff00998314983b68a3e7caac07a66ebe496",
              "status": "affected",
              "version": "a73105b8d4c765d9ebfb664d0a66802127d8e4c7",
              "versionType": "git"
            },
            {
              "lessThan": "32edd2a28e112064020a2f319a8cb8a9e5a09767",
              "status": "affected",
              "version": "a73105b8d4c765d9ebfb664d0a66802127d8e4c7",
              "versionType": "git"
            },
            {
              "lessThan": "4dab98961426d0cf6a1599cda6950b7596ca2fcd",
              "status": "affected",
              "version": "a73105b8d4c765d9ebfb664d0a66802127d8e4c7",
              "versionType": "git"
            },
            {
              "lessThan": "730de8733dd90f70d7580a9b329b971f8e1474a2",
              "status": "affected",
              "version": "a73105b8d4c765d9ebfb664d0a66802127d8e4c7",
              "versionType": "git"
            },
            {
              "lessThan": "ed28ead3420c373a7928622f114bc6168075d1e1",
              "status": "affected",
              "version": "a73105b8d4c765d9ebfb664d0a66802127d8e4c7",
              "versionType": "git"
            },
            {
              "lessThan": "b64963a2ceeb7529310b6cf253a1e540784422f4",
              "status": "affected",
              "version": "a73105b8d4c765d9ebfb664d0a66802127d8e4c7",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/batman-adv/types.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.1"
            },
            {
              "lessThan": "3.1",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.258",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.209",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.175",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.142",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.92",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.34",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.258",
                  "versionStartIncluding": "3.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.209",
                  "versionStartIncluding": "3.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.175",
                  "versionStartIncluding": "3.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.142",
                  "versionStartIncluding": "3.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.92",
                  "versionStartIncluding": "3.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.34",
                  "versionStartIncluding": "3.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.11",
                  "versionStartIncluding": "3.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "3.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbatman-adv: tt: fix negative tt_buff_len\n\nbatadv_orig_node::tt_buff_len was declared as s16, but the field is never\nintended to hold a negative value. When a value greater than 32767 is\nassigned, it wraps to a negative signed integer.\n\nIn batadv_send_other_tt_response(), tt_buff_len is temporarily widened to\ns32. The incorrectly negative s16 value propagates into the s32, causing\nbatadv_tt_prepare_tvlv_global_data() to allocate a full sized buffer but\npopulates only a small portion of it with the collected changeset. All\nremaining bits are kept uninitialized.\n\nUsing an u16 avoids this type confusion and ensures that no (negative) sign\nextension is performed in batadv_send_other_tt_response()."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - Batman-adv processes attacker-controlled translation-table TVLV traffic from mesh peers over WiFi/Ethernet L2; exploitation requires the attacker to be on the same wireless or LAN segment as the victim mesh node, matching the Adjacent definition for WiFi/L2 mesh protocols.\nAC:L - An adjacent mesh attacker can send unauthenticated TT_REQUEST/TT_RESPONSE/OGM TVLV packets to populate `tt_buff_len` and then trigger `batadv_send_other_tt_response()` without depending on victim-controlled timing or memory layout.\nPR:N - The vulnerable path is reached from pre-authentication mesh control-plane packet handling (`batadv_recv_unicast_tvlv` \u2192 `batadv_tt_tvlv_unicast_handler_v1`); no Linux credentials or capabilities are required on the victim host beyond having an active batman-adv mesh interface.\nUI:N - Exploitation requires only crafted mesh protocol packets from an adjacent attacker; no victim user action (opening files, clicking links, etc.) is needed at attack time.\nS:U - Impact is confined to kernel memory disclosure/corruption and potential local privilege escalation within the same kernel security authority; it does not cross VM, container, or IOMMU boundaries.\nC:H - Sign-extended negative `tt_buff_len` causes `batadv_tt_prepare_tvlv_global_data()` to allocate a large buffer but only partially fill it, leaving the remainder uninitialized and transmitted to the requester in the TT_RESPONSE via `batadv_tvlv_unicast_send()`.\nI:H - The same type confusion passes a negative `s16` length to `memcpy()`, which promotes to a very large `size_t` and can cause out-of-bounds reads/writes from the undersized `tt_buff` allocation, enabling heap memory corruption.\nA:H - The malformed `memcpy()` and associated heap corruption can trigger kernel oops/panic on the responding mesh node, and the bug class inherently threatens system availability even when not fully weaponized."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:39:05.060Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/4c4c2f340f4c27373bfcac8dc5032ce7bb474e47"
        },
        {
          "url": "https://git.kernel.org/stable/c/33e5ede7ce6d92e531920d4bbd6d3e18ef1c6430"
        },
        {
          "url": "https://git.kernel.org/stable/c/3c96dff00998314983b68a3e7caac07a66ebe496"
        },
        {
          "url": "https://git.kernel.org/stable/c/32edd2a28e112064020a2f319a8cb8a9e5a09767"
        },
        {
          "url": "https://git.kernel.org/stable/c/4dab98961426d0cf6a1599cda6950b7596ca2fcd"
        },
        {
          "url": "https://git.kernel.org/stable/c/730de8733dd90f70d7580a9b329b971f8e1474a2"
        },
        {
          "url": "https://git.kernel.org/stable/c/ed28ead3420c373a7928622f114bc6168075d1e1"
        },
        {
          "url": "https://git.kernel.org/stable/c/b64963a2ceeb7529310b6cf253a1e540784422f4"
        }
      ],
      "title": "batman-adv: tt: fix negative tt_buff_len",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64088",
    "datePublished": "2026-07-19T15:39:58.084Z",
    "dateReserved": "2026-07-19T07:54:57.032Z",
    "dateUpdated": "2026-08-05T12:39:05.060Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-64088",
      "date": "2026-08-10",
      "epss": "0.00281",
      "percentile": "0.20332"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-64088\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-07-19T16:17:49.557\",\"lastModified\":\"2026-07-30T14:59:47.950\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbatman-adv: tt: fix negative tt_buff_len\\n\\nbatadv_orig_node::tt_buff_len was declared as s16, but the field is never\\nintended to hold a negative value. When a value greater than 32767 is\\nassigned, it wraps to a negative signed integer.\\n\\nIn batadv_send_other_tt_response(), tt_buff_len is temporarily widened to\\ns32. The incorrectly negative s16 value propagates into the s32, causing\\nbatadv_tt_prepare_tvlv_global_data() to allocate a full sized buffer but\\npopulates only a small portion of it with the collected changeset. All\\nremaining bits are kept uninitialized.\\n\\nUsing an u16 avoids this type confusion and ensures that no (negative) sign\\nextension is performed in batadv_send_other_tt_response().\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/batman-adv/types.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"a73105b8d4c765d9ebfb664d0a66802127d8e4c7\",\"lessThan\":\"4c4c2f340f4c27373bfcac8dc5032ce7bb474e47\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"a73105b8d4c765d9ebfb664d0a66802127d8e4c7\",\"lessThan\":\"33e5ede7ce6d92e531920d4bbd6d3e18ef1c6430\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"a73105b8d4c765d9ebfb664d0a66802127d8e4c7\",\"lessThan\":\"3c96dff00998314983b68a3e7caac07a66ebe496\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"a73105b8d4c765d9ebfb664d0a66802127d8e4c7\",\"lessThan\":\"32edd2a28e112064020a2f319a8cb8a9e5a09767\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"a73105b8d4c765d9ebfb664d0a66802127d8e4c7\",\"lessThan\":\"4dab98961426d0cf6a1599cda6950b7596ca2fcd\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"a73105b8d4c765d9ebfb664d0a66802127d8e4c7\",\"lessThan\":\"730de8733dd90f70d7580a9b329b971f8e1474a2\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"a73105b8d4c765d9ebfb664d0a66802127d8e4c7\",\"lessThan\":\"ed28ead3420c373a7928622f114bc6168075d1e1\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"a73105b8d4c765d9ebfb664d0a66802127d8e4c7\",\"lessThan\":\"b64963a2ceeb7529310b6cf253a1e540784422f4\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/batman-adv/types.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"3.1\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"3.1\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.258\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.209\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.175\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.142\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.92\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.34\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.0.11\",\"lessThanOrEqual\":\"7.0.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"ADJACENT_NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/32edd2a28e112064020a2f319a8cb8a9e5a09767\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/33e5ede7ce6d92e531920d4bbd6d3e18ef1c6430\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/3c96dff00998314983b68a3e7caac07a66ebe496\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/4c4c2f340f4c27373bfcac8dc5032ce7bb474e47\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/4dab98961426d0cf6a1599cda6950b7596ca2fcd\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/730de8733dd90f70d7580a9b329b971f8e1474a2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/b64963a2ceeb7529310b6cf253a1e540784422f4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/ed28ead3420c373a7928622f114bc6168075d1e1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-08-05T14:15:35+00:00",
      "cve": "CVE-2026-64088",
      "id": "CVE-2026-64088",
      "initial_release_date": "2026-07-19T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: batman-adv: tt: fix negative tt_buff_len",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64088.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-05T00:33:44Z",
      "cve": "CVE-2026-64088",
      "id": "CVE-2026-64088",
      "initial_release_date": "2026-07-21T12:59:55Z",
      "product_status:known_affected": "222",
      "product_status:known_not_affected": "74",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-64088",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-64088.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.