CVE-2026-64089: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-64089 Overview

CVE-2026-64089 is a sign extension vulnerability in the Linux kernel's batman-adv (B.A.T.M.A.N. Advanced) mesh networking module. The flaw resides in the translation table (TT) handling code, where batadv_priv_tt::last_changeset_len was declared as a signed 16-bit integer (s16) but was never intended to hold negative values. When the field stores a value greater than 32767, it wraps to a negative signed integer, causing type confusion when later widened to s32 in batadv_send_my_tt_response().

The result is that batadv_tt_prepare_tvlv_local_data() allocates a full-sized buffer but only populates a small portion of it, leaking uninitialized kernel memory over the network.

Critical Impact
Remote attackers on a batman-adv mesh network can trigger disclosure of uninitialized kernel memory contents through crafted translation table responses, potentially exposing sensitive kernel data.

Affected Products

Linux kernel versions containing the batman-adv module prior to the fixing commits
Linux distributions shipping vulnerable kernels with CONFIG_BATMAN_ADV enabled
Mesh networking deployments using B.A.T.M.A.N. Advanced routing

Discovery Timeline

2026-07-19 - CVE-2026-64089 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-64089

Vulnerability Analysis

The vulnerability is a sign extension error [CWE-194] combined with information disclosure of uninitialized memory. The batadv_priv_tt::last_changeset_len field tracks the length of the last translation table changeset in the batman-adv mesh routing protocol. Although semantically an unsigned length, it was typed as s16, permitting values above 32767 to silently become negative.

When batadv_send_my_tt_response() widens this s16 to s32, the C compiler performs sign extension. A negative s16 propagates its sign bit into the upper 16 bits of the s32, producing a large negative s32 value where a positive length was expected.

The downstream function batadv_tt_prepare_tvlv_local_data() then allocates a buffer based on the intended (positive) size but only fills a small portion with legitimate changeset data. The unfilled remainder of the buffer retains prior heap contents and is transmitted to remote mesh peers.

Root Cause

The root cause is incorrect signed integer type selection for a length field. Using s16 for a value that is inherently unsigned created an implicit precondition — that lengths never exceed 32767 — which the code did not enforce. Changing the field type to u16 prevents the negative wraparound and eliminates sign extension when the value is promoted to a wider type.

Attack Vector

The attack vector is network-based. An attacker with access to a batman-adv mesh network can craft translation table interactions that push last_changeset_len into the vulnerable range. This triggers the sign-extended memory allocation and causes the vulnerable node to emit oversized TT response frames containing uninitialized kernel heap memory to attacker-controlled mesh peers.

Since batman-adv operates at layer 2, exploitation requires the attacker to be adjacent on the mesh network or otherwise participate in batman-adv frame exchange. No authentication is required by the batman-adv protocol itself.

No public proof-of-concept exploit is currently available. Technical details of the fix are documented in the upstream Linux kernel commits, including Linux Kernel Commit 179eb62 and Linux Kernel Commit fc92cdc.

Detection Methods for CVE-2026-64089

Indicators of Compromise

Unusually large or malformed batman-adv translation table (TT) response frames observed on mesh interfaces
Kernel warnings or unexpected allocation sizes originating from batadv_tt_prepare_tvlv_local_data()
Unexpected traffic bursts from mesh nodes carrying uninitialized-looking payload patterns

Detection Strategies

Inventory Linux hosts with the batman-adv module loaded using lsmod | grep batman_adv and correlate against patched kernel versions
Monitor kernel version telemetry to identify systems running vulnerable builds prior to the fixing commits referenced in the NVD entry
Deploy network sensors on mesh segments to inspect batman-adv TVLV frame lengths and flag anomalous TT response sizes

Monitoring Recommendations

Enable kernel audit logging for module load events involving batman_adv and track configuration changes to mesh interfaces
Correlate mesh network traffic anomalies with endpoint telemetry to identify nodes emitting suspicious TT responses
Track CVE patch status across Linux fleets via configuration management and vulnerability scanning tools

How to Mitigate CVE-2026-64089

Immediate Actions Required

Update the Linux kernel to a version that includes the batman-adv fix commits listed in the NVD advisory
Identify all hosts with batman-adv compiled or loaded and prioritize patching for nodes participating in mesh networks
If patching is not immediately possible, unload the batman_adv module on systems that do not require mesh routing using modprobe -r batman_adv

Patch Information

The fix changes batadv_priv_tt::last_changeset_len from s16 to u16, preventing negative wraparound and eliminating sign extension when the value is promoted to s32 in batadv_send_my_tt_response(). The fix is available across multiple stable kernel branches via the following commits: 179eb62, 22d59c7, 55dc41f, 6314089, c424e85, d29abf7, eb23547, and fc92cdc.

Workarounds

Blacklist the batman_adv kernel module on systems that do not require mesh networking to eliminate the attack surface entirely
Restrict physical and wireless access to mesh network segments so untrusted peers cannot participate in batman-adv frame exchange
Segment batman-adv mesh interfaces from sensitive networks to limit the scope of any information disclosed

bash

# Blacklist the batman_adv module to prevent load at boot
echo 'blacklist batman_adv' | sudo tee /etc/modprobe.d/blacklist-batman-adv.conf
sudo modprobe -r batman_adv

# Verify the module is not currently loaded
lsmod | grep batman_adv

# Check running kernel version against patched builds
uname -r