CVE-2026-64089

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the batman-adv module where the last changeset len field in batadv piv tt is declared as a signed 16-bit integer (s16). Because this field should not hold negative values, assigning a value greater than 32767 causes it to wrap to a negative signed integer. In the batadv send my tt response() function, this negative value is widened to a signed 32-bit integer (s32), leading the batadv tt prepare tvlv local data() function to allocate a full-sized buffer while only populating a small portion of it. This results in the remaining bits of the buffer remaining uninitialized, creating a type confusion scenario.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.