The vulnerability (CVE-2026-64088) in the Linux kernel's batman-adv mesh networking subsystem arises from the signed 16-bit field batadv_orig_node::tt_buff_len being used in a context where values greater than 32767 cause it to wrap to a negative number. This negative value propagates into a 32-bit signed integer, leading to a buffer allocation that is larger than the initialized data, leaving parts of the buffer uninitialized. The root cause is a type confusion between signed and unsigned integers. The fix involves changing tt_buff_len to an unsigned 16-bit type (u16) to prevent sign extension and negative values. This vulnerability was resolved in Linux kernel versions patched after the affected versions listed. The issue was disclosed with a CVSS 3.1 score of 8.8, indicating high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. The vendor advisory from Ubuntu confirms the availability of patches and recommends updating to fixed kernel versions.

The vulnerability allows an attacker with network access to the affected Linux kernel to potentially cause improper memory handling due to uninitialized buffer regions. This can lead to information disclosure, and possibly other impacts affecting confidentiality, integrity, and availability of the system. The CVSS score of 8.8 reflects a high severity impact with the potential for significant compromise if exploited. However, there are no known exploits in the wild at this time.

A patch is available and should be applied by updating the Linux kernel to the fixed versions provided by the vendor. Ubuntu security notices USN-8575-1 and USN-8576-1 provide updated kernel packages that address this and other vulnerabilities. After applying the update, a system reboot is required. Due to an ABI change, third-party kernel modules must be recompiled and reinstalled. Users should follow the vendor's update instructions carefully to ensure full remediation.