High 8.8Published Jul 19, 2026

CVE-2026-64088batman-adv: tt: fix negative tt_buff_len

Updated under an hour ago (Oct 27, 2026, 3:00 AM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: batman-adv: tt: fix negative tt_buff_len batadv_orig_node::tt_buff_len was declared as s16, but the field is never intended to hold a negative value. When a value greater than 32767 is assigned, it wraps to a negative signed integer. In batadv_send_other_tt_response(), tt_buff_len is temporarily widened to s32. The incorrectly negative s16 value propagates into the s32, causing batadv_tt_prepare_tvlv_global_data() to allocate a full sized buffer but populates only a small portion of it with the collected changeset. All remaining bits are kept uninitialized. Using an u16 avoids this type confusion and ensures that no (negative) sign extension is performed in batadv_send_other_tt_response().

CVSS: 8.8 HIGH (v3.1, CNA)CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Analyzed
Record last updated: Aug 5, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from a73105b8d4c765d9ebfb664d0a66802127d8e4c7 before 4c4c2f340f4c27373bfcac8dc5032ce7bb474e47; from a73105b8d4c765d9ebfb664d0a66802127d8e4c7 before 33e5ede7ce6d92e531920d4bbd6d3e18ef1c6430; from a73105b8d4c765d9ebfb664d0a66802127d8e4c7 before 3c96dff00998314983b68a3e7caac07a66ebe496; from a73105b8d4c765d9ebfb664d0a66802127d8e4c7 before 32edd2a28e112064020a2f319a8cb8a9e5a09767; from a73105b8d4c765d9ebfb664d0a66802127d8e4c7 before 4dab98961426d0cf6a1599cda6950b7596ca2fcd; from a73105b8d4c765d9ebfb664d0a66802127d8e4c7 before 730de8733dd90f70d7580a9b329b971f8e1474a2; from a73105b8d4c765d9ebfb664d0a66802127d8e4c7 before ed28ead3420c373a7928622f114bc6168075d1e1; from a73105b8d4c765d9ebfb664d0a66802127d8e4c7 before b64963a2ceeb7529310b6cf253a1e540784422f4	CNA record
linux linux_kernel linux:linux_kernel	from 3.1 before 5.10.258; from 5.11 before 5.15.209; from 5.16 before 6.1.175; from 6.2 before 6.6.142; from 6.7 before 6.12.92; from 6.13 before 6.18.34; from 6.19 before 7.0.11; 7.1; and 3 more ranges	NVD

References

References

https://git.kernel.org/stable/c/4c4c2f340f4c27373bfcac8dc5032ce7bb474e47	patch
https://git.kernel.org/stable/c/33e5ede7ce6d92e531920d4bbd6d3e18ef1c6430	patch
https://git.kernel.org/stable/c/3c96dff00998314983b68a3e7caac07a66ebe496	patch
https://git.kernel.org/stable/c/32edd2a28e112064020a2f319a8cb8a9e5a09767	patch
https://git.kernel.org/stable/c/4dab98961426d0cf6a1599cda6950b7596ca2fcd	patch
https://git.kernel.org/stable/c/730de8733dd90f70d7580a9b329b971f8e1474a2	patch
https://git.kernel.org/stable/c/ed28ead3420c373a7928622f114bc6168075d1e1	patch
https://git.kernel.org/stable/c/b64963a2ceeb7529310b6cf253a1e540784422f4	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.