CVE-2026-31659
batman-adv: reject oversized global TT response buffers
Reported by linux · Published April 24, 2026
In the Linux kernel, the following vulnerability has been resolved: batman-adv: reject oversized global TT response buffers batadv_tt_prepare_tvlv_global_data() builds the allocation length for a global TT response in 16-bit temporaries. When a remote originator advertises a large enough global TT, the TT payload length plus the VLAN header offset can exceed 65535 and wrap before kmalloc(). The full-table response path still uses the original TT payload length when it fills tt_change, so the wrapped allocation is too small and batadv_tt_prepare_tvlv_global_data() writes past the end of the heap object before the later packet-size check runs. Fix this by rejecting TT responses whose TVLV value length cannot fit in the 16-bit TVLV payload length field.
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| Linux | Linux | 7ea7b4a142758deaf46c1af0ca9ceca6dd55138b, 7ea7b4a142758deaf46c1af0ca9ceca6dd55138b, 7ea7b4a142758deaf46c1af0ca9ceca6dd55138b |
| Linux | Linux | 3.13, 0, 5.10.253 |
| linux | linux_kernel | 3.13, 3.13, 3.13 |
| Linux | Linux | 7.0, 7ea7b4a142758deaf46c1af0ca9ceca6dd55138b, 7ea7b4a142758deaf46c1af0ca9ceca6dd55138b |
Timeline
- Apr 24, 2026 CVE Published
- Apr 24, 2026 Security Advisory (103 in total, the first dated here)
- May 18, 2026 EPSS Score (30 in total, the first dated here)
- Jul 18, 2026 Coalition ESS Score
- Aug 10, 2026 CVE Updated
- Aug 11, 2026 Distribution Patch (97 in total, the first dated here)
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2026-31659
vulnetix vdb fixes CVE-2026-31659Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2026-31659/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart