CVE-2026-31659 batman-adv: reject oversized global TT response buffers
An integer overflow in the batman-adv kernel module allows heap buffer overflows, potentially leading to code execution or denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-31659?
CVE-2026-31659 is a critical vulnerability in Linux kernel, published on 24 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
batman-adv: reject oversized global TT response buffers
batadv_tt_prepare_tvlv_global_data() builds the allocation length for a global TT response in 16-bit temporaries. When a remote originator advertises a large enough global TT, the TT payload length plus the VLAN header offset can exceed 65535 and wrap before kmalloc().
The full-table response path still uses the original TT payload length when it fills tt_change, so the wrapped allocation is too small and batadv_tt_prepare_tvlv_global_data() writes past the end of the heap object before the later packet-size check runs.
Fix this by rejecting TT responses whose TVLV value length cannot fit in the 16-bit TVLV payload length field.
Weakness: CWE-190
Which versions are affected by CVE-2026-31659?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-31659?
Apply the vendor's patch.
Is CVE-2026-31659 being exploited?
There is no known exploitation of CVE-2026-31659 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-83870, BELL-CVE-2026-31659, DEBIAN-CVE-2026-31659, GHSA-8jfv-frvf-4g4v, ROOT-OS-DEBIAN-11-CVE-2026-31659, ROOT-OS-DEBIAN-12-CVE-2026-31659 and 3 more.