Linux Kernel batadv Sign-Extension Bug Causes Uninitialized Buffer
CVE-2026-64089 Published on July 19, 2026
batman-adv: tt: fix negative last_changeset_len
In the Linux kernel, the following vulnerability has been resolved:
batman-adv: tt: fix negative last_changeset_len
batadv_piv_tt::last_changeset_len len was declared as s16, but the field is
never intended to hold a negative value. When a value greater than 32767 is
assigned, it wraps to a negative signed integer.
In batadv_send_my_tt_response(), last_changeset_len is temporarily widened
to s32. The incorrectly negative s16 value propagates into the s32, causing
batadv_tt_prepare_tvlv_local_data() to allocate a full sized buffer but
populates only a small portion of it with the collected changeset. All
remaining bits are kept uninitialized.
Using an u16 avoids this type confusion and ensures that no (negative) sign
extension is performed in batadv_send_my_tt_response().
Products Associated with CVE-2026-64089
stack.watch emails you whenever new vulnerabilities are published in Linux Kernel or Canonical Ubuntu Linux. Just hit a watch button to start following.
Affected Versions
Linux:- Version a73105b8d4c765d9ebfb664d0a66802127d8e4c7 and below 6314089acf0ddf64376fdc0b1420695504c73f52 is affected.
- Version a73105b8d4c765d9ebfb664d0a66802127d8e4c7 and below 55dc41fe8821e9a849e147255ad572bc933a9d15 is affected.
- Version a73105b8d4c765d9ebfb664d0a66802127d8e4c7 and below c424e8519ac78eac5d9f4eecf06208a0d619ec14 is affected.
- Version a73105b8d4c765d9ebfb664d0a66802127d8e4c7 and below 22d59c72f4a47ffec121d0610f70d0d70c3c11c8 is affected.
- Version a73105b8d4c765d9ebfb664d0a66802127d8e4c7 and below eb235472b52ef36981c5aad330485eaf2382c53b is affected.
- Version a73105b8d4c765d9ebfb664d0a66802127d8e4c7 and below 179eb62506a02d00370bd6478898cb632e10986c is affected.
- Version a73105b8d4c765d9ebfb664d0a66802127d8e4c7 and below d29abf70c665730e249d2ec8e1402095ae26bcee is affected.
- Version a73105b8d4c765d9ebfb664d0a66802127d8e4c7 and below fc92cdfcb295cefa4344d71a527d61b638b7bfc4 is affected.
- Version 3.1 is affected.
- Before 3.1 is unaffected.
- Version 5.10.258, <= 5.10.* is unaffected.
- Version 5.15.209, <= 5.15.* is unaffected.
- Version 6.1.175, <= 6.1.* is unaffected.
- Version 6.6.142, <= 6.6.* is unaffected.
- Version 6.12.92, <= 6.12.* is unaffected.
- Version 6.18.34, <= 6.18.* is unaffected.
- Version 7.0.11, <= 7.0.* is unaffected.
- Version 7.1, <= * is unaffected.