CVE-2026-64088

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the batman-adv module where the tt buff len field in batadv orig node is declared as a signed 16-bit integer (s16). Because this field should not hold negative values, assigning a value greater than 32767 causes it to wrap to a negative signed integer. In the batadv send other tt response() function, this negative value is widened to a 32-bit signed integer (s32), leading the batadv tt prepare tvlv global data() function to allocate a full-sized buffer while only populating a small portion of it with the collected changeset. This results in the remaining bits of the buffer remaining uninitialized.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.