The Linux kernel's batman-adv module had a vulnerability (CVE-2026-64089) caused by the last_changeset_len variable being declared as a signed 16-bit integer (s16) despite never being intended to hold negative values. Assigning values greater than 32767 caused the variable to wrap to negative numbers due to signed integer overflow. This negative value propagated when temporarily widened to a signed 32-bit integer (s32), leading to batadv_tt_prepare_tvlv_local_data allocating a full-sized buffer but only partially initializing it. The remaining buffer contents were left uninitialized, potentially exposing uninitialized memory. The issue was fixed by changing last_changeset_len to an unsigned 16-bit integer (u16), preventing negative sign extension and ensuring proper buffer initialization.

The vulnerability causes a buffer to be allocated at full size but only partially populated with valid data, leaving the rest uninitialized. This could lead to information disclosure or unpredictable behavior due to use of uninitialized memory. No known exploits in the wild have been reported. The impact is limited to the batman-adv module in the Linux kernel and involves memory handling errors related to integer sign confusion.

A fix has been implemented in the Linux kernel to address this vulnerability by changing the last_changeset_len variable from a signed 16-bit integer to an unsigned 16-bit integer. Users should apply the official Linux kernel updates that include this fix. Patch status is not explicitly confirmed in the provided data; therefore, check the vendor or Linux kernel advisory for the latest remediation guidance.