High 8.8Published May 28, 2026

CVE-2026-46198batman-adv: fix integer overflow on buff_pos

Updated under an hour ago (Oct 27, 2026, 7:00 PM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: batman-adv: fix integer overflow on buff_pos Fixing an integer overflow present in batadv_iv_ogm_send_to_if. The size check is done using the int type in batadv_iv_ogm_aggr_packet whereas the buff_pos variable uses the s16 type. This could lead to an out-of-bound read.

CVSS: 8.8 HIGH (v3.1, CNA)CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Analyzed
Record last updated: Aug 5, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from c6c8fea29769d998d94fcec9b9f14d4b52b349d3 before 867cd090760e8f5cd206f387b47ff9c56fac04e9; from c6c8fea29769d998d94fcec9b9f14d4b52b349d3 before 10bb1f366d884d506c38a947b43026a75d1afe9a; from c6c8fea29769d998d94fcec9b9f14d4b52b349d3 before 96c9c0ed9a9579a9085765aceaa4556a6666eb82; from c6c8fea29769d998d94fcec9b9f14d4b52b349d3 before f61499359fa529f0d45a53bf7c573a49eb6322e6; from c6c8fea29769d998d94fcec9b9f14d4b52b349d3 before 974542d1efc48b7e9fe16184e647615cba39969b; from c6c8fea29769d998d94fcec9b9f14d4b52b349d3 before bf872db54f91ffe70104b98c20068b2d5910e018; from c6c8fea29769d998d94fcec9b9f14d4b52b349d3 before b252797bfced986d6d92ec2f4cfcca842ce8aa78; from c6c8fea29769d998d94fcec9b9f14d4b52b349d3 before 0799e5943611006b346b8813c7daf7dd5aa26bfd	CNA record
linux linux_kernel linux:linux_kernel	from 2.6.38 before 5.10.258; from 5.11 before 5.15.209; from 5.16 before 6.1.175; from 6.2 before 6.6.140; from 6.7 before 6.12.90; from 6.13 before 6.18.32; from 6.19 before 7.0.9; 7.1; and 2 more ranges	NVD

References

References

https://git.kernel.org/stable/c/867cd090760e8f5cd206f387b47ff9c56fac04e9	patch
https://git.kernel.org/stable/c/10bb1f366d884d506c38a947b43026a75d1afe9a	patch
https://git.kernel.org/stable/c/96c9c0ed9a9579a9085765aceaa4556a6666eb82	patch
https://git.kernel.org/stable/c/f61499359fa529f0d45a53bf7c573a49eb6322e6	patch
https://git.kernel.org/stable/c/974542d1efc48b7e9fe16184e647615cba39969b	patch
https://git.kernel.org/stable/c/bf872db54f91ffe70104b98c20068b2d5910e018	patch
https://git.kernel.org/stable/c/b252797bfced986d6d92ec2f4cfcca842ce8aa78	patch
https://git.kernel.org/stable/c/0799e5943611006b346b8813c7daf7dd5aa26bfd	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.