CVE-2026-80839 in Linux
Summary
by MITRE • 09/04/2026
In the Linux kernel, the following vulnerability has been resolved:
batman-adv: reject unrepresentable multicast TVLV offsets
The network and transport header fields in struct sk_buff are 16-bit offsets from skb->head, and U16_MAX is reserved as the unset transport header value. batadv_tvlv_call_handler() sets both fields from a received multicast TVLV without checking whether the TVLV end is representable.
If the end offset exceeds the field's range, skb_set_transport_header() truncates it so that the transport header precedes the network header. The negative difference is then returned by skb_network_header_len() as a large u32. batadv_mcast_forw_packet() consequently accepts an oversized multicast tracker and accesses memory beyond the skb data.
Add skb_set_transport_header_careful(), an offset-aware counterpart to skb_reset_transport_header_careful(), which validates the final head-relative offset before assigning it. Use the new helper in batadv_tvlv_call_handler() and reject unrepresentable TVLVs before setting the network header.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/04/2026
The Linux kernel vulnerability identified within the BATMAN-ADV module involves a critical input validation failure that leads to out-of-bounds memory access, posing significant risks of denial of service or potential code execution through crafted multicast packets. The core technical flaw resides in how the batadv_tvlv_call_handler function processes received Multicast TVLV (Type-Length-Value) data structures. Specifically, this handler sets both network and transport header fields within the sk_buff structure using 16-bit offsets relative to the start of the buffer head. A fundamental constraint exists where U16_MAX is reserved as a sentinel value indicating an unset transport header. However, the original implementation failed to verify whether the calculated end offset of the incoming TVLV data was representable within these 16-bit fields before assignment. This lack of boundary checking allows maliciously crafted packets with excessively large offsets to bypass initial validation checks and proceed into deeper kernel processing routines without triggering immediate rejection based on size constraints.
When an unrepresentable offset is processed, the subsequent call to skb_set_transport_header results in a truncation behavior that fundamentally breaks the expected memory layout assumptions of the network stack. If the end offset exceeds the maximum value for a 16-bit unsigned integer, it wraps around or gets truncated such that the transport header position appears to precede the network header position within the buffer structure. This inversion causes the function skb_network_header_len to return a negative difference when calculating the length of the network header. Because this result is stored in an unsigned 32-bit variable, the negative value is interpreted as a very large positive integer representing an enormous packet length. This erroneous length calculation directly impacts downstream functions that rely on accurate buffer boundaries for safe memory access operations.
The operational impact becomes severe when batadv_mcast_forw_packet utilizes this inflated header length to determine how much multicast tracker data to process. Consequently, the function accepts a multicast tracker size derived from the corrupted offset calculations and proceeds to access memory regions beyond the actual allocated sk_buff data buffer. This out-of-bounds read constitutes an information disclosure vulnerability that could potentially leak kernel stack or heap contents to remote attackers via network traffic analysis. Furthermore, depending on subsequent write operations triggered by similar logic paths in other parts of the multicast handling subsystem, this flaw could theoretically be leveraged for arbitrary memory writes, leading to privilege escalation or complete system compromise. The attack vector is particularly dangerous because it exploits normal protocol processing workflows using specially constructed packets that appear valid at a superficial level but contain malformed offset values designed to trigger integer overflow and logic errors in header management routines.
To mitigate this vulnerability, the kernel developers implemented a new helper function named skb_set_transport_header_careful which serves as an offset-aware counterpart to existing safe header setting functions. This utility validates whether the final head-relative offset falls within acceptable bounds before assigning it to the transport header field of the sk_buff structure. By integrating this validation step into batadv_tvlv_call_handler, the system now rejects unrepresentable TVLVs at the earliest possible stage, preventing them from propagating through the network stack and causing memory corruption or unauthorized data access. This fix aligns with industry-standard security practices by enforcing strict input validation on all external data inputs before they influence internal state variables that govern memory layout. The vulnerability is categorized under CWE-190 Integer Overflow or Wraparound as well as CWE-787 Out-of-bounds Write, reflecting the root cause of the flawed arithmetic and its resulting unsafe memory access pattern. From a threat intelligence perspective, this flaw maps to ATT&CK technique T1564.002 Hidden Files and Directories if used for persistence or more accurately to T1059 Command and Scripting Interpreter if leveraged for execution, though primarily it represents an initial exploitation vector via network-based input manipulation similar to CVE-2023-XXXX series kernel vulnerabilities involving packet parsing flaws.