CVE-2026-31659: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-31659 Overview

CVE-2026-31659 is a heap buffer overflow vulnerability in the Linux kernel's batman-adv mesh networking module. The flaw resides in batadv_tt_prepare_tvlv_global_data(), which computes allocation lengths for global Translation Table (TT) responses using 16-bit temporaries. A remote originator advertising a sufficiently large global TT can cause the TT payload length plus VLAN header offset to exceed 65535 and wrap before kmalloc(). The full-table response path then uses the original TT payload length to fill tt_change, writing past the end of the undersized heap object. This out-of-bounds write occurs before the later packet-size check executes, enabling network-adjacent attackers to corrupt kernel heap memory.

Critical Impact
Remote attackers on a batman-adv mesh can trigger a kernel heap overflow without authentication or user interaction, leading to potential code execution or denial of service.

Affected Products

Linux Kernel (multiple stable branches, including 3.13 baseline and 7.0 release candidates rc1–rc7)
Systems with the batman-adv mesh networking module enabled
Distributions shipping vulnerable Linux kernel versions until backported patches are applied

Discovery Timeline

2026-04-24 - CVE-2026-31659 published to NVD
2026-04-27 - Last updated in NVD database

Technical Details for CVE-2026-31659

Vulnerability Analysis

The vulnerability is a heap-based out-of-bounds write rooted in an integer overflow [CWE-122/CWE-190 class]. The batman-adv protocol implements a mesh-wide Translation Table that maps client MAC addresses to originator nodes. When a peer requests a full-table TT response, batadv_tt_prepare_tvlv_global_data() calculates the buffer size needed to serialize all known TT entries plus per-VLAN headers.

Because the intermediate length computation uses 16-bit temporaries, an attacker-controlled large TT advertisement causes the sum of the TT payload length and the VLAN header offset to wrap modulo 65536. The wrapped, smaller value is passed to kmalloc(), producing an undersized allocation. The downstream serialization routine, however, continues to use the original full TT payload length when filling the tt_change array, writing well past the end of the allocated object on the kernel heap.

Root Cause

The root cause is unsafe arithmetic on 16-bit integers used to size a heap allocation. The TVLV (type/version/length/value) payload length field is itself 16 bits wide, but the code does not reject TT responses whose computed TVLV value length cannot fit in that field. The packet-size sanity check runs only after the overflow has already corrupted memory. The upstream fix rejects TT responses whose TVLV value length exceeds the 16-bit field capacity before any allocation occurs.

Attack Vector

Exploitation requires the ability to inject batman-adv protocol frames into a mesh that the victim participates in. A malicious or compromised originator advertises a global TT large enough to trigger the 16-bit wrap during response preparation on a peer. No authentication is required because batman-adv mesh participants implicitly trust originator-advertised TT data. The vulnerability described is a remote, pre-authentication kernel memory corruption primitive against any host running batman-adv. See the upstream patches referenced in the Linux Kernel stable git repository for the fix implementation.

Detection Methods for CVE-2026-31659

Indicators of Compromise

Kernel oops, BUG, KASAN, or slab-out-of-bounds reports referencing batadv_tt_prepare_tvlv_global_data or batadv_send_tt_response
Unexpected kernel panics or soft lockups on hosts running batman-adv shortly after receiving mesh traffic from a new or untrusted originator
Anomalously large TT advertisements observed in mesh telemetry or packet captures of batman-adv control traffic

Detection Strategies

Monitor dmesg and journald for KASAN, general protection fault, or kernel BUG entries with batadv_ symbols in the stack trace
Inspect batman-adv control plane traffic for TVLV payloads where the encoded value length approaches or exceeds the 16-bit boundary
Correlate kernel crash telemetry with the presence of the batman_adv module loaded via lsmod across the fleet

Monitoring Recommendations

Enable kernel crash collection (kdump, pstore) on mesh-connected Linux hosts to capture exploitation attempts
Track installed kernel package versions against the patched commits listed in the upstream stable advisories
Alert on unexpected loading of the batman_adv module on systems that do not require mesh networking

How to Mitigate CVE-2026-31659

Immediate Actions Required

Apply the upstream kernel patches from the stable branches as soon as distribution updates are available
Inventory all Linux systems with the batman_adv kernel module loaded and prioritize patching mesh-connected hosts
Restrict participation in batman-adv meshes to trusted originators using network segmentation where the protocol design allows

Patch Information

The Linux kernel maintainers shipped fixes across multiple stable branches in commits 2997f4bd1f98, 3a359bf5c61d, 69d61639bc7e, 7e5d007e0df9, 95c71365a222, cf2199171ef7, de6c1dc3c7d0, and f970646b9a39. The patch rejects any TT response whose TVLV value length cannot fit in the 16-bit TVLV payload length field, eliminating the integer wrap before allocation. Refer to the Linux stable kernel commits for the authoritative fix.

Workarounds

Unload the batman_adv module on hosts that do not require mesh networking using modprobe -r batman_adv
Blacklist the module via /etc/modprobe.d/ to prevent automatic load on reboot
Isolate mesh-participating systems on dedicated network segments to limit exposure to untrusted originators

bash

# Disable the batman-adv module on systems that do not require it
sudo modprobe -r batman_adv
echo 'blacklist batman_adv' | sudo tee /etc/modprobe.d/blacklist-batman-adv.conf
sudo update-initramfs -u

# Verify the module is not loaded
lsmod | grep batman_adv