CVE-2026-46198

batman-adv: fix integer overflow on buff_pos

State: Published
Severity: 8.8 High
Published: May 28, 2026
Updated: Aug 5, 2026
Reserved: May 13, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

batman-adv: fix integer overflow on buff_pos

Fixing an integer overflow present in batadv_iv_ogm_send_to_if. The size check is done using the int type in batadv_iv_ogm_aggr_packet whereas the buff_pos variable uses the s16 type. This could lead to an out-of-bound read.

Scores

CVSS	Score	Vector	Source
3.1	8.8 High	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	c6c8fea29769d998d94fcec9b9f14d4b52b349d3 to before 867cd090760e8f5cd206f387b47ff9c56fac04e9Affected c6c8fea29769d998d94fcec9b9f14d4b52b349d3 to before 10bb1f366d884d506c38a947b43026a75d1afe9aAffected c6c8fea29769d998d94fcec9b9f14d4b52b349d3 to before 96c9c0ed9a9579a9085765aceaa4556a6666eb82Affected c6c8fea29769d998d94fcec9b9f14d4b52b349d3 to before f61499359fa529f0d45a53bf7c573a49eb6322e6Affected c6c8fea29769d998d94fcec9b9f14d4b52b349d3 to before 974542d1efc48b7e9fe16184e647615cba39969bAffected c6c8fea29769d998d94fcec9b9f14d4b52b349d3 to before bf872db54f91ffe70104b98c20068b2d5910e018Affected c6c8fea29769d998d94fcec9b9f14d4b52b349d3 to before b252797bfced986d6d92ec2f4cfcca842ce8aa78Affected c6c8fea29769d998d94fcec9b9f14d4b52b349d3 to before 0799e5943611006b346b8813c7daf7dd5aa26bfdAffected
LinuxLinux	2.6.38Affected before 2.6.38Not affected 5.10.258 through 5.10.Not affected 5.15.209 through 5.15.Not affected 6.1.175 through 6.1.Not affected 6.6.140 through 6.6.Not affected 6.12.90 through 6.12.Not affected 6.18.32 through 6.18.Not affected 7.0.9 through 7.0.*Not affected 7.1 and laterNot affected

Product

Versions

LinuxLinux

c6c8fea29769d998d94fcec9b9f14d4b52b349d3 to before 867cd090760e8f5cd206f387b47ff9c56fac04e9Affected
c6c8fea29769d998d94fcec9b9f14d4b52b349d3 to before 10bb1f366d884d506c38a947b43026a75d1afe9aAffected
c6c8fea29769d998d94fcec9b9f14d4b52b349d3 to before 96c9c0ed9a9579a9085765aceaa4556a6666eb82Affected
c6c8fea29769d998d94fcec9b9f14d4b52b349d3 to before f61499359fa529f0d45a53bf7c573a49eb6322e6Affected
c6c8fea29769d998d94fcec9b9f14d4b52b349d3 to before 974542d1efc48b7e9fe16184e647615cba39969bAffected
c6c8fea29769d998d94fcec9b9f14d4b52b349d3 to before bf872db54f91ffe70104b98c20068b2d5910e018Affected
c6c8fea29769d998d94fcec9b9f14d4b52b349d3 to before b252797bfced986d6d92ec2f4cfcca842ce8aa78Affected
c6c8fea29769d998d94fcec9b9f14d4b52b349d3 to before 0799e5943611006b346b8813c7daf7dd5aa26bfdAffected

LinuxLinux

2.6.38Affected
before 2.6.38Not affected
5.10.258 through 5.10.*Not affected
5.15.209 through 5.15.*Not affected
6.1.175 through 6.1.*Not affected
6.6.140 through 6.6.*Not affected
6.12.90 through 6.12.*Not affected
6.18.32 through 6.18.*Not affected
7.0.9 through 7.0.*Not affected
7.1 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.