Answer in brief
CVE-2026-31659 records a Critical severity (CVSS 9.8) vulnerability in batman-adv: reject oversized global TT response buffers. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 9.8. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | 3.13 | Not reported |
| Linux/Linuxgeneric | >=7ea7b4a142758deaf46c1af0ca9ceca6dd55138b <7e5d007e0df946bffb8542fb112e0044014a5897 || >=7ea7b4a142758deaf46c1af0ca9ceca6dd55138b <2997f4bd1f982e7013709946e00be89b507693fa || >=7ea7b4a142758deaf46c1af0ca9ceca6dd55138b <95c71365a2222908441b54d6f2c315e0c79fcec3 || >=7ea7b4a142758deaf46c1af0ca9ceca6dd55138b <69d61639bc7e963c3b645e570279d731e7c89062 || >=7ea7b4a142758deaf46c1af0ca9ceca6dd55138b <f970646b9a39539d1bac86822ac78b5915455ea9 || >=7ea7b4a142758deaf46c1af0ca9ceca6dd55138b <de6c1dc3c7d01a152607e6fcecee4d5288283f10 || >=7ea7b4a142758deaf46c1af0ca9ceca6dd55138b <cf2199171ef799ca7270019125f4a91bd20ad4d9 || >=7ea7b4a142758deaf46c1af0ca9ceca6dd55138b <3a359bf5c61d52e7f09754108309d637532164a6 | 7e5d007e0df946bffb8542fb112e0044014a5897, 2997f4bd1f982e7013709946e00be89b507693fa, 95c71365a2222908441b54d6f2c315e0c79fcec3, 69d61639bc7e963c3b645e570279d731e7c89062, f970646b9a39539d1bac86822ac78b5915455ea9, de6c1dc3c7d01a152607e6fcecee4d5288283f10, cf2199171ef799ca7270019125f4a91bd20ad4d9, 3a359bf5c61d52e7f09754108309d637532164a6 |
Published upstream
Apr 24, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 16, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Oct 16, 2026
In the Linux kernel, the following vulnerability has been resolved: batman-adv: reject oversized global TT response buffers batadv_tt_prepare_tvlv_global_data() builds the allocation length for a global TT response in 16-bit temporaries. When a remote originator advertises a large enough global TT, the TT payload length plus the VLAN header offset can exceed 65535 and wrap before kmalloc(). The full-table response path still uses the original TT payload length when it fills tt_change, so the wrapped allocation is too small and batadv_tt_prepare_tvlv_global_data() writes past the end of the heap object before the later packet-size check runs. Fix this by rejecting TT responses whose TVLV value length cannot fit in the 16-bit TVLV payload length field.
Quoted source text, attributed separately from HOL analysis.