In the Linux kernel, the following vulnerability has been resolved: batman-adv: tt: fix negative tt_buff_len batadv_orig_node::tt_buff_len was… (CVE-2026-64088)
In the Linux kernel, the following vulnerability has been resolved: batman-adv: tt: fix negative tt_buff_len batadv_orig_node::tt_buff_len was declared as s16, but the field is never intended to hold a negative value. When a value greater than 32767 is assigned, it wraps to a negative signed integer. In batadv_send_other_tt_response(), tt_buff_len is temporarily widened to s32. The incorrectly negative s16 value propagates into the s32, causing batadv_tt_prepare_tvlv_global_data() to allocate a full sized buffer but populates only a small portion of it with the collected changeset. All remaining bits are kept uninitialized. Using an u16 avoids this type confusion and ensures that no (negative) sign extension is performed in batadv_send_other_tt_response().
AI Analysis
Technical Summary
The vulnerability in the Linux kernel's batman-adv module relates to the tt_buff_len field declared as a signed 16-bit integer (s16) but used in a context where negative values are invalid. Assigning values greater than 32767 causes the value to wrap into a negative signed integer, which propagates through the code and results in batadv_tt_prepare_tvlv_global_data() allocating a full-sized buffer but only partially initializing it. This leads to uninitialized memory being used. The issue was resolved by changing tt_buff_len to an unsigned 16-bit integer (u16), eliminating sign extension and type confusion.
Potential Impact
The vulnerability causes uninitialized memory to be used in buffer allocation within the batman-adv kernel module. This could potentially lead to information leakage or undefined behavior due to use of uninitialized data. No known exploits in the wild have been reported.
Mitigation Recommendations
A fix has been implemented in the Linux kernel to address this issue by changing the data type of tt_buff_len from signed to unsigned 16-bit. Users should update to the fixed Linux kernel version containing this patch once available. Patch status is not explicitly confirmed here; check the official Linux kernel advisories or vendor updates for the exact fixed versions and apply updates accordingly.
In the Linux kernel, the following vulnerability has been resolved: batman-adv: tt: fix negative tt_buff_len batadv_orig_node::tt_buff_len was… (CVE-2026-64088)
Description
In the Linux kernel, the following vulnerability has been resolved: batman-adv: tt: fix negative tt_buff_len batadv_orig_node::tt_buff_len was declared as s16, but the field is never intended to hold a negative value. When a value greater than 32767 is assigned, it wraps to a negative signed integer. In batadv_send_other_tt_response(), tt_buff_len is temporarily widened to s32. The incorrectly negative s16 value propagates into the s32, causing batadv_tt_prepare_tvlv_global_data() to allocate a full sized buffer but populates only a small portion of it with the collected changeset. All remaining bits are kept uninitialized. Using an u16 avoids this type confusion and ensures that no (negative) sign extension is performed in batadv_send_other_tt_response().
CVSS v3.1
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in the Linux kernel's batman-adv module relates to the tt_buff_len field declared as a signed 16-bit integer (s16) but used in a context where negative values are invalid. Assigning values greater than 32767 causes the value to wrap into a negative signed integer, which propagates through the code and results in batadv_tt_prepare_tvlv_global_data() allocating a full-sized buffer but only partially initializing it. This leads to uninitialized memory being used. The issue was resolved by changing tt_buff_len to an unsigned 16-bit integer (u16), eliminating sign extension and type confusion.
Potential Impact
The vulnerability causes uninitialized memory to be used in buffer allocation within the batman-adv kernel module. This could potentially lead to information leakage or undefined behavior due to use of uninitialized data. No known exploits in the wild have been reported.
Mitigation Recommendations
A fix has been implemented in the Linux kernel to address this issue by changing the data type of tt_buff_len from signed to unsigned 16-bit. Users should update to the fixed Linux kernel version containing this patch once available. Patch status is not explicitly confirmed here; check the official Linux kernel advisories or vendor updates for the exact fixed versions and apply updates accordingly.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-r69h-9cf6-78mg
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-64088"]
- Ecosystems
- []
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a5d27a82a4a8d598912b536
Added to database: 07/19/2026, 19:38:16 UTC
Last enriched: 07/19/2026, 19:47:17 UTC
Last updated: 07/20/2026, 19:41:21 UTC
Views: 12
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.