Linux Kernel: batman-adv Reject Oversized Global TT Response TVLV Wrap
CVE-2026-31659 Published on April 24, 2026
batman-adv: reject oversized global TT response buffers
In the Linux kernel, the following vulnerability has been resolved:
batman-adv: reject oversized global TT response buffers
batadv_tt_prepare_tvlv_global_data() builds the allocation length for a
global TT response in 16-bit temporaries. When a remote originator
advertises a large enough global TT, the TT payload length plus the VLAN
header offset can exceed 65535 and wrap before kmalloc().
The full-table response path still uses the original TT payload length when
it fills tt_change, so the wrapped allocation is too small and
batadv_tt_prepare_tvlv_global_data() writes past the end of the heap object
before the later packet-size check runs.
Fix this by rejecting TT responses whose TVLV value length cannot fit in
the 16-bit TVLV payload length field.
Products Associated with CVE-2026-31659
Want to know whenever a new CVE is published for Linux Kernel? stack.watch will email you.
Affected Versions
Linux:- Version 7ea7b4a142758deaf46c1af0ca9ceca6dd55138b and below 7e5d007e0df946bffb8542fb112e0044014a5897 is affected.
- Version 7ea7b4a142758deaf46c1af0ca9ceca6dd55138b and below 2997f4bd1f982e7013709946e00be89b507693fa is affected.
- Version 7ea7b4a142758deaf46c1af0ca9ceca6dd55138b and below 95c71365a2222908441b54d6f2c315e0c79fcec3 is affected.
- Version 7ea7b4a142758deaf46c1af0ca9ceca6dd55138b and below 69d61639bc7e963c3b645e570279d731e7c89062 is affected.
- Version 7ea7b4a142758deaf46c1af0ca9ceca6dd55138b and below f970646b9a39539d1bac86822ac78b5915455ea9 is affected.
- Version 7ea7b4a142758deaf46c1af0ca9ceca6dd55138b and below de6c1dc3c7d01a152607e6fcecee4d5288283f10 is affected.
- Version 7ea7b4a142758deaf46c1af0ca9ceca6dd55138b and below cf2199171ef799ca7270019125f4a91bd20ad4d9 is affected.
- Version 7ea7b4a142758deaf46c1af0ca9ceca6dd55138b and below 3a359bf5c61d52e7f09754108309d637532164a6 is affected.
- Version 3.13 is affected.
- Before 3.13 is unaffected.
- Version 5.10.253, <= 5.10.* is unaffected.
- Version 5.15.203, <= 5.15.* is unaffected.
- Version 6.1.169, <= 6.1.* is unaffected.
- Version 6.6.135, <= 6.6.* is unaffected.
- Version 6.12.82, <= 6.12.* is unaffected.
- Version 6.18.23, <= 6.18.* is unaffected.
- Version 6.19.13, <= 6.19.* is unaffected.
- Version 7.0, <= * is unaffected.