CVE-2026-72226 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
batman-adv: tt: prevent TVLV OOB check overflow
A TT unicast TVLV contains the number of VLANs stored in it. This number is an u16 and gets multiplied by the size of the struct batadv_tvlv_tt_vlan_data (8 bytes). The size can therefore overflow the u16 used to store the tt_vlan_len. All additional safety checks to prevent out-of-bounds access of the TVLV buffer are invalid due to this overflow.
Using size_t prevents this overflow and ensures that the safety checks compare against the actual buffer requirements.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/15/2026
The vulnerability in question affects the batman-adv kernel module, which implements the B.A.T.M.A.N. advanced routing protocol for wireless mesh networks. This specific issue resides within the translation table (TT) handling mechanism where unicast TVLV (Type-Length-Value) structures are processed. The flaw manifests when processing TT unicast TVLV packets that contain information about VLANs within the mesh network, creating a critical buffer overflow scenario that could potentially lead to system compromise.
The technical root cause stems from improper integer handling in the calculation of buffer requirements for VLAN data processing. Specifically, the number of VLANs stored in the TT unicast TVLV is represented as a u16 (unsigned 16-bit integer) which gets multiplied by the fixed size of struct batadv_tvlv_tt_vlan_data at 8 bytes. When the number of VLANs exceeds 32767, this multiplication operation causes an arithmetic overflow within the u16 data type, resulting in a corrupted tt_vlan_len value that no longer accurately represents the actual buffer requirements. This fundamental miscalculation invalidates all subsequent bounds checking mechanisms designed to prevent out-of-bounds memory access.
The operational impact of this vulnerability extends beyond simple buffer corruption, as it creates potential attack vectors for malicious actors within the mesh network. An attacker could craft specially formatted TT unicast TVLV packets containing an excessive number of VLAN entries, triggering the overflow condition and potentially enabling arbitrary code execution or denial of service conditions. The vulnerability affects systems running kernel versions where batman-adv is implemented, particularly those operating in wireless mesh network environments where such TVLV processing occurs regularly. This represents a critical security risk given that mesh networks often operate in untrusted environments where malicious nodes could exploit this weakness to disrupt network operations or gain unauthorized access.
This vulnerability aligns with CWE-190, Integer Overflow or Wraparound, and specifically relates to CWE-129, Improper Validation of Array Index. The issue also maps to ATT&CK technique T1059.007 for Command and Scripting Interpreter: Python, as the exploitation could involve crafting malicious network traffic that triggers the vulnerable code path through legitimate protocol processing. Mitigation strategies should focus on upgrading to kernel versions containing the fix where size_t is used instead of u16 for buffer length calculations, ensuring that all arithmetic operations maintain proper overflow protection. Additionally, network administrators should implement monitoring for unusual TT unicast TVLV packet patterns and consider implementing rate limiting or filtering rules at the network level to prevent exploitation attempts. The fix demonstrates proper defensive programming practices by using appropriately sized integer types that can accommodate the full range of possible buffer requirements without introducing overflow conditions.