CVE-2026-64088 in Linux
Summary
by MITRE • 07/19/2026
In the Linux kernel, the following vulnerability has been resolved:
batman-adv: tt: fix negative tt_buff_len
batadv_orig_node::tt_buff_len was declared as s16, but the field is never intended to hold a negative value. When a value greater than 32767 is assigned, it wraps to a negative signed integer.
In batadv_send_other_tt_response(), tt_buff_len is temporarily widened to s32. The incorrectly negative s16 value propagates into the s32, causing batadv_tt_prepare_tvlv_global_data() to allocate a full sized buffer but populates only a small portion of it with the collected changeset. All remaining bits are kept uninitialized.
Using an u16 avoids this type confusion and ensures that no (negative) sign extension is performed in batadv_send_other_tt_response().
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/19/2026
The vulnerability in question involves a critical type confusion issue within the batman-adv kernel module, specifically affecting the translation table handling mechanism. This flaw exists in the distributed routing protocol implementation used for wireless mesh networks, where the tt_buff_len field in the batadv_orig_node structure is declared as a signed 16-bit integer. The fundamental problem arises from the assumption that this field should never contain negative values, yet the code does not enforce this constraint, allowing values exceeding 32767 to wrap around and become negative due to signed integer overflow behavior. This type of vulnerability falls under CWE-190, which specifically addresses integer overflow and wraparound conditions.
The operational impact becomes particularly severe when examining how batadv_send_other_tt_response() processes this field, as it temporarily widens the tt_buff_len value to a 32-bit signed integer. When the negative wrapped value propagates through this function, it triggers incorrect buffer allocation behavior in batadv_tt_prepare_tvlv_global_data(), where instead of allocating a small buffer for the actual data, the system allocates a full-sized buffer. This creates a significant memory management issue where only a small portion of the allocated buffer gets properly populated with the translation table changeset data, leaving all remaining bits uninitialized and potentially containing sensitive information from previous operations.
This vulnerability represents a classic example of improper handling of signed vs unsigned integer types, which aligns with ATT&CK technique T1070.004 related to "File and Directory Permissions Modification" and T1553.006 for "Sign Tool", as it creates conditions where uninitialized memory could potentially leak information or create unexpected behavior in network packet processing. The use of an unsigned 16-bit integer would resolve this issue by eliminating the possibility of sign extension and ensuring that values are properly constrained within their intended range, preventing the wraparound condition that leads to incorrect buffer allocation. This type of fix addresses fundamental security concerns related to memory safety and prevents potential information disclosure or denial-of-service conditions in mesh network environments where proper buffer management is crucial for maintaining system stability and data integrity.
The resolution involves a straightforward but critical change from s16 to u16 declaration for the tt_buff_len field, which eliminates the type confusion that occurs during arithmetic operations and function calls. This change ensures that when values exceed 32767, they do not wrap to negative values and subsequently cause incorrect buffer sizing behavior. The fix directly addresses the root cause by preventing sign extension issues that could lead to improper memory allocation decisions, thereby maintaining the integrity of the translation table processing mechanism within the batman-adv kernel module and ensuring proper handling of mesh network routing information without creating potential attack vectors through memory corruption or information leakage.