The Linux kernel's batman-adv mesh networking subsystem contained a vulnerability (CVE-2026-64089) due to the use of a signed 16-bit integer (s16) for the field last_changeset_len, which was not intended to hold negative values. When values greater than 32767 were assigned, the signed integer wrapped to a negative value, causing sign extension issues when widened to a 32-bit integer. This led to batadv_tt_prepare_tvlv_local_data() allocating a full-sized buffer but only partially initializing it, leaving the remainder uninitialized. The fix involved changing last_changeset_len to an unsigned 16-bit integer (u16), preventing negative sign extension and ensuring proper buffer initialization. This vulnerability affects multiple Linux kernel versions prior to certain 5.15.x updates and has been addressed in official patches.

The vulnerability allows improper memory handling that could lead to exposure of uninitialized kernel memory, potentially leaking sensitive information or causing instability. The CVSS score of 9.8 reflects critical impact on confidentiality, integrity, and availability, meaning an attacker could fully compromise the affected system without privileges or user interaction. No known exploits are reported in the wild at this time.

An official patch is available and should be applied promptly. The affected Linux kernel versions are fixed in updates starting from versions 5.15.0-1112.119~20.04.1 and later. Users should update their systems using standard package management tools and reboot to apply the kernel updates. Note that due to ABI changes, third-party kernel modules may need recompilation and reinstallation after the update. Follow vendor instructions for updating and rebuilding kernel modules as necessary.