In the Linux kernel, the following vulnerability has been resolved: batman-adv: tt: fix negative tt_buff_len batadv_orig_node::tt_buff_len was… (CVE-2026-64088)

The Linux kernel's batman-adv mesh networking protocol contained a vulnerability (CVE-2026-64088) due to the use of a signed 16-bit integer (s16) for the field batadv_orig_node::tt_buff_len, which was not intended to hold negative values. When values greater than 32767 were assigned, the value wrapped to a negative signed integer. This negative value propagated into a widened 32-bit integer, causing the function batadv_tt_prepare_tvlv_global_data() to allocate a full-sized buffer but only partially initialize it, leaving the rest uninitialized. The fix involved changing the field to an unsigned 16-bit integer (u16) to prevent sign extension and type confusion. This vulnerability was resolved in Linux kernel updates as detailed in Ubuntu security advisories USN-8575-1 and USN-8576-1, which also addressed numerous other kernel security issues.

The vulnerability allows improper memory handling due to uninitialized buffer portions, which could be exploited to compromise system confidentiality, integrity, and availability. The CVSS 3.1 score of 8.8 reflects high impact across these security properties. Although no known exploits are reported in the wild, the flaw could potentially be leveraged by an attacker with network access to affect the Linux kernel's batman-adv subsystem.

A patch is available and should be applied by updating the Linux kernel to versions at or beyond the fixed releases. Ubuntu security advisories USN-8575-1 and USN-8576-1 provide updated kernel packages that address this and other vulnerabilities. After updating, a system reboot is required. Note that due to an ABI change, third-party kernel modules must be recompiled and reinstalled. Follow vendor instructions carefully to ensure full remediation.