CVE-2026-64088: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-64088 Overview

CVE-2026-64088 is a sign extension error in the Linux kernel's batman-adv (Better Approach To Mobile Ad-hoc Networking) module. The batadv_orig_node::tt_buff_len field was declared as a signed 16-bit integer (s16), but the field is not intended to hold negative values. When a value greater than 32767 is assigned, it wraps to a negative signed integer.

The negative s16 value propagates into an s32 in batadv_send_other_tt_response(). This causes batadv_tt_prepare_tvlv_global_data() to allocate a full sized buffer while populating only a small portion with valid changeset data. The remainder of the buffer is transmitted with uninitialized kernel memory.

Critical Impact
Uninitialized kernel memory can leak to adjacent-network peers through batman-adv translation table responses, enabling information disclosure and integrity impact on mesh network participants.

Affected Products

Linux kernel versions containing the batman-adv module prior to the fix
Mesh networking deployments using B.A.T.M.A.N. advanced routing
Stable kernel branches referenced in the upstream commit series

Discovery Timeline

2026-07-19 - CVE-2026-64088 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-64088

Vulnerability Analysis

The vulnerability is a Sign Extension Error combined with Uninitialized Memory Use. The batman-adv protocol maintains a translation table (TT) mapping client MAC addresses to originator nodes across the mesh. Each originator stores its own TT buffer length in batadv_orig_node::tt_buff_len.

Because the field was typed as s16, any legitimate value above 32767 bytes wraps into a negative number. When batadv_send_other_tt_response() widens this value to s32, the compiler performs sign extension, preserving the negative value in the wider type.

The function batadv_tt_prepare_tvlv_global_data() uses the widened length to size the TVLV (Type-Length-Value) buffer allocation. Downstream logic only fills a portion of the buffer with actual translation table entries, leaving the rest populated with whatever kernel data previously occupied that memory. This memory is then transmitted over the mesh to the requesting peer.

Root Cause

The root cause is improper integer type selection. Fields representing byte counts must use unsigned types when negative values carry no semantic meaning. Widening a negative s16 through sign extension into s32 preserved the incorrect value rather than treating it as an unsigned quantity, producing a mismatch between the allocation size and the populated content.

Attack Vector

Exploitation requires adjacent network access, meaning the attacker must be able to inject or trigger batman-adv protocol traffic on the same mesh segment as the vulnerable node. An attacker capable of forcing a tt_buff_len above 32767, or requesting a global TT response from a node whose length has wrapped, receives responses containing uninitialized kernel memory. The uninitialized bytes may include pointers, kernel addresses, cryptographic material, or fragments of other data structures.

The vulnerability is described in prose because no verified proof-of-concept code has been released. Technical details are available in the upstream fix commits on kernel.org.

Detection Methods for CVE-2026-64088

Indicators of Compromise

Unusually large batman-adv TT_RESPONSE frames observed on mesh interfaces
TVLV payloads containing non-TT structured data patterns following valid translation table entries
Kernel messages referencing batadv_send_other_tt_response in error or warning contexts

Detection Strategies

Inspect batman-adv diagnostic files under /sys/kernel/debug/batman_adv/*/transtable_global for entries with anomalous byte counts
Capture mesh traffic with tcpdump on the bat0 interface and analyze TT response frame lengths against advertised entry counts
Monitor kernel version and confirm the fixing commits (32edd2a2, 4c4c2f34, 730de873) are present in the running kernel

Monitoring Recommendations

Enable auditd rules for kernel module load events involving batman_adv
Forward kernel logs to a centralized logging system and alert on batadv warnings or crashes
Baseline expected mesh traffic volume and alert on outbound TT response frames exceeding historical maxima

How to Mitigate CVE-2026-64088

Immediate Actions Required

Apply the upstream kernel patches referenced by kernel.org commits 32edd2a28e11, 33e5ede7ce6d, 3c96dff00998, 4c4c2f340f4c, 4dab98961426, 730de8733dd9, b64963a2ceeb, and ed28ead3420c
Update to a stable Linux kernel release incorporating the tt_buff_len type change from s16 to u16
Restrict mesh network membership to trusted peers using batman-adv authentication where feasible

Patch Information

The fix changes the type of batadv_orig_node::tt_buff_len from s16 to u16, eliminating both the wrap-to-negative behavior and any sign extension when the value is promoted to a wider integer. Distribution vendors ship the fix through stable kernel updates. Reference commits are published at Kernel.org batman-adv fix commit and its companion backports.

Workarounds

Disable the batman-adv kernel module on systems that do not require mesh routing using modprobe -r batman_adv and blacklisting the module
Segment mesh networks to prevent untrusted devices from originating TT requests
Restrict the maximum number of client entries per originator through operational limits until patched kernels are deployed

bash

# Blacklist batman-adv until kernel is patched
echo "blacklist batman_adv" | sudo tee /etc/modprobe.d/blacklist-batman-adv.conf
sudo modprobe -r batman_adv

# Verify running kernel includes the fix
uname -r
zgrep -i "batman-adv: tt: fix negative tt_buff_len" /usr/share/doc/linux-image-*/changelog* 2>/dev/null