High 8.8Published Jun 24, 2026

CVE-2026-52934batman-adv: tvlv: reject oversized TVLV packets

Updated under an hour ago (Oct 28, 2026, 4:50 AM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: batman-adv: tvlv: reject oversized TVLV packets batadv_tvlv_container_ogm_append() builds a TVLV packet section from the tvlv.container_list. The total size of this section is computed by batadv_tvlv_container_list_size(), which sums the sizes of all registered containers. The return type and accumulator in batadv_tvlv_container_list_size() were u16. If the accumulated size exceeds U16_MAX, the value wraps around, causing the subsequent allocation in batadv_tvlv_container_ogm_append() to be undersized. The memcpy-style copy that follows would then write beyond the end of the allocated buffer, corrupting kernel memory. Fix this by widening the return type of batadv_tvlv_container_list_size() to size_t. In batadv_tvlv_container_ogm_append(), check the computed length against U16_MAX before proceeding, and bail out as if the allocation had failed when the limit is exceeded.

CVSS: 8.8 HIGH (v3.1, CNA)CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Analyzed
Record last updated: Aug 5, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from ef26157747d42254453f6b3ac2bd8bd3c53339c3 before c02aa6c0c9d1bea9bb75dea362b75ad225137bae; from ef26157747d42254453f6b3ac2bd8bd3c53339c3 before 1595628a2f877d052eda18865ccf539392c47c04; from ef26157747d42254453f6b3ac2bd8bd3c53339c3 before 6448a49344e87487b61bd88cb850cd694a0f576d; from ef26157747d42254453f6b3ac2bd8bd3c53339c3 before 13493b00dd1e05a705981e052158652ea23eb482; from ef26157747d42254453f6b3ac2bd8bd3c53339c3 before 94db72e9dac202e017ee3db22c59d17e4f3bf171; from ef26157747d42254453f6b3ac2bd8bd3c53339c3 before ede47988ac5687793745b17c1634a496a2299919; from ef26157747d42254453f6b3ac2bd8bd3c53339c3 before 94a3d72cd9b21116d7c6d5bdc57c11401fc28557; from ef26157747d42254453f6b3ac2bd8bd3c53339c3 before f50487e3566358b2b982b7801945e858c78ad9ab	CNA record
linux linux_kernel linux:linux_kernel	from 3.13 before 5.10.259; from 5.11 before 5.15.210; from 5.16 before 6.1.176; from 6.2 before 6.6.143; from 6.7 before 6.12.93; from 6.13 before 6.18.34; from 6.19 before 7.0.11; 7.1; and 3 more ranges	NVD

References

References

https://git.kernel.org/stable/c/c02aa6c0c9d1bea9bb75dea362b75ad225137bae	patch
https://git.kernel.org/stable/c/1595628a2f877d052eda18865ccf539392c47c04	patch
https://git.kernel.org/stable/c/6448a49344e87487b61bd88cb850cd694a0f576d	patch
https://git.kernel.org/stable/c/13493b00dd1e05a705981e052158652ea23eb482	patch
https://git.kernel.org/stable/c/94db72e9dac202e017ee3db22c59d17e4f3bf171	patch
https://git.kernel.org/stable/c/ede47988ac5687793745b17c1634a496a2299919	patch
https://git.kernel.org/stable/c/94a3d72cd9b21116d7c6d5bdc57c11401fc28557	patch
https://git.kernel.org/stable/c/f50487e3566358b2b982b7801945e858c78ad9ab	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.