CVE-2026-72226batman-adv: tt: prevent TVLV OOB check overflow
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: batman-adv: tt: prevent TVLV OOB check overflow A TT unicast TVLV contains the number of VLANs stored in it. This number is an u16 and gets multiplied by the size of the struct batadv_tvlv_tt_vlan_data (8 bytes). The size can therefore overflow the u16 used to store the tt_vlan_len. All additional safety checks to prevent out-of-bounds access of the TVLV buffer are invalid due to this overflow. Using size_t prevents this overflow and ensures that the safety checks compare against the actual buffer requirements.
- CVSS
- 9.8 CRITICAL (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | 7ea7b4a142758deaf46c1af0ca9ceca6dd55138b builds before 0de12a4c4847f571d82a9cd96bc633eded41d7c6; from 7ea7b4a142758deaf46c1af0ca9ceca6dd55138b before d6ff4764ff784ede25f5c83a6f5883a74c93a5ea; from 7ea7b4a142758deaf46c1af0ca9ceca6dd55138b before 1898273c5dc8148267ef9f97cd2517a2822350e7; from 7ea7b4a142758deaf46c1af0ca9ceca6dd55138b before 604bd5042fbcd1ab9f7cd98fd847ec017aeede8a; from 7ea7b4a142758deaf46c1af0ca9ceca6dd55138b before 7319c0794f91be2734aac695794e7203606b49f8; from 7ea7b4a142758deaf46c1af0ca9ceca6dd55138b before 3256c05d5a9db34346eaf20f52dddde984852d77; from 7ea7b4a142758deaf46c1af0ca9ceca6dd55138b before 6222b443686525cb5a9b6a9cecf23b2e2ab23e2a; 7ea7b4a142758deaf46c1af0ca9ceca6dd55138b builds before 7a581d9aaba8c82bd6177fa36b2588eea77f6e2b | CNA record |
References
- https://git.kernel.org/stable/c/0de12a4c4847f571d82a9cd96bc633eded41d7c6
- https://git.kernel.org/stable/c/d6ff4764ff784ede25f5c83a6f5883a74c93a5ea
- https://git.kernel.org/stable/c/1898273c5dc8148267ef9f97cd2517a2822350e7
- https://git.kernel.org/stable/c/604bd5042fbcd1ab9f7cd98fd847ec017aeede8a
- https://git.kernel.org/stable/c/7319c0794f91be2734aac695794e7203606b49f8
- https://git.kernel.org/stable/c/3256c05d5a9db34346eaf20f52dddde984852d77
- https://git.kernel.org/stable/c/6222b443686525cb5a9b6a9cecf23b2e2ab23e2a
- https://git.kernel.org/stable/c/7a581d9aaba8c82bd6177fa36b2588eea77f6e2b
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.