CVE-2026-72226

batman-adv: tt: prevent TVLV OOB check overflow

State: Published
Severity: 9.8 Critical
Published: Aug 15, 2026
Updated: Oct 16, 2026
Reserved: Aug 9, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

batman-adv: tt: prevent TVLV OOB check overflow

A TT unicast TVLV contains the number of VLANs stored in it. This number is an u16 and gets multiplied by the size of the struct batadv_tvlv_tt_vlan_data (8 bytes). The size can therefore overflow the u16 used to store the tt_vlan_len. All additional safety checks to prevent out-of-bounds access of the TVLV buffer are invalid due to this overflow.

Using size_t prevents this overflow and ensures that the safety checks compare against the actual buffer requirements.

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	7ea7b4a142758deaf46c1af0ca9ceca6dd55138b to before 0de12a4c4847f571d82a9cd96bc633eded41d7c6Affected 7ea7b4a142758deaf46c1af0ca9ceca6dd55138b to before d6ff4764ff784ede25f5c83a6f5883a74c93a5eaAffected 7ea7b4a142758deaf46c1af0ca9ceca6dd55138b to before 1898273c5dc8148267ef9f97cd2517a2822350e7Affected 7ea7b4a142758deaf46c1af0ca9ceca6dd55138b to before 604bd5042fbcd1ab9f7cd98fd847ec017aeede8aAffected 7ea7b4a142758deaf46c1af0ca9ceca6dd55138b to before 7319c0794f91be2734aac695794e7203606b49f8Affected 7ea7b4a142758deaf46c1af0ca9ceca6dd55138b to before 3256c05d5a9db34346eaf20f52dddde984852d77Affected 7ea7b4a142758deaf46c1af0ca9ceca6dd55138b to before 6222b443686525cb5a9b6a9cecf23b2e2ab23e2aAffected 7ea7b4a142758deaf46c1af0ca9ceca6dd55138b to before 7a581d9aaba8c82bd6177fa36b2588eea77f6e2bAffected
LinuxLinux	3.13Affected before 3.13Not affected 5.10.261 through 5.10.Not affected 5.15.212 through 5.15.Not affected 6.1.178 through 6.1.Not affected 6.6.145 through 6.6.Not affected 6.12.97 through 6.12.Not affected 6.18.40 through 6.18.Not affected 7.1.5 through 7.1.*Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

7ea7b4a142758deaf46c1af0ca9ceca6dd55138b to before 0de12a4c4847f571d82a9cd96bc633eded41d7c6Affected
7ea7b4a142758deaf46c1af0ca9ceca6dd55138b to before d6ff4764ff784ede25f5c83a6f5883a74c93a5eaAffected
7ea7b4a142758deaf46c1af0ca9ceca6dd55138b to before 1898273c5dc8148267ef9f97cd2517a2822350e7Affected
7ea7b4a142758deaf46c1af0ca9ceca6dd55138b to before 604bd5042fbcd1ab9f7cd98fd847ec017aeede8aAffected
7ea7b4a142758deaf46c1af0ca9ceca6dd55138b to before 7319c0794f91be2734aac695794e7203606b49f8Affected
7ea7b4a142758deaf46c1af0ca9ceca6dd55138b to before 3256c05d5a9db34346eaf20f52dddde984852d77Affected
7ea7b4a142758deaf46c1af0ca9ceca6dd55138b to before 6222b443686525cb5a9b6a9cecf23b2e2ab23e2aAffected
7ea7b4a142758deaf46c1af0ca9ceca6dd55138b to before 7a581d9aaba8c82bd6177fa36b2588eea77f6e2bAffected

LinuxLinux

3.13Affected
before 3.13Not affected
5.10.261 through 5.10.*Not affected
5.15.212 through 5.15.*Not affected
6.1.178 through 6.1.*Not affected
6.6.145 through 6.6.*Not affected
6.12.97 through 6.12.*Not affected
6.18.40 through 6.18.*Not affected
7.1.5 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.