CVE-2026-80839: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-80839 Overview

CVE-2026-80839 is a Linux kernel vulnerability in the batman-adv (B.A.T.M.A.N. Advanced) mesh networking module. The flaw resides in batadv_tvlv_call_handler(), which sets the network and transport header offsets from a received multicast Type-Length-Value (TVLV) container without validating that the TVLV end offset fits within the 16-bit range used by struct sk_buff header fields.

When the end offset exceeds the representable range, skb_set_transport_header() truncates it. This causes skb_network_header_len() to return a large u32, and batadv_mcast_forw_packet() then reads memory beyond the socket buffer data.

Critical Impact
A crafted multicast TVLV frame on a batman-adv mesh interface can trigger an out-of-bounds read in kernel memory, potentially leading to information disclosure or a kernel crash.

Affected Products

Linux kernel builds containing the batman-adv module prior to the fix commits
Distributions shipping batman-adv mesh networking (commonly used in OpenWrt, community mesh deployments, and embedded routers)
Systems with CONFIG_BATMAN_ADV enabled

Discovery Timeline

2026-09-04 - CVE-2026-80839 published to the National Vulnerability Database
2026-09-04 - Last updated in NVD database

Technical Details for CVE-2026-80839

Vulnerability Analysis

The batman-adv module implements a layer-2 mesh routing protocol that carries auxiliary metadata inside TVLV containers. In batadv_tvlv_call_handler(), the kernel computes the position of the network and transport headers based on offsets derived from the incoming TVLV. The network_header and transport_header fields in struct sk_buff are stored as 16-bit offsets from skb->head, with U16_MAX reserved as the sentinel for an unset transport header.

The original code assigned these fields without verifying that the computed end of the TVLV fits within the 16-bit range. When the value overflows, skb_set_transport_header() truncates the assignment, placing the transport header before the network header. The subsequent call to skb_network_header_len() returns the negative difference as an unsigned 32-bit value, producing a very large length.

batadv_mcast_forw_packet() uses that length as a valid multicast tracker size and reads beyond the sk_buff data buffer. The result is an out-of-bounds read in kernel context [CWE-125], reachable from any node able to inject multicast TVLV traffic onto a mesh interface.

Root Cause

The root cause is missing bounds validation on head-relative offsets before assigning them to 16-bit sk_buff header fields. batadv_tvlv_call_handler() trusted attacker-influenced TVLV length values and passed them into skb_set_transport_header() without ensuring the final offset was representable.

Attack Vector

Exploitation requires the ability to send crafted multicast TVLV frames to a target participating in a batman-adv mesh. On open community mesh networks or misconfigured wireless deployments, any peer node can transmit such frames. The attacker constructs a multicast TVLV whose declared end offset exceeds U16_MAX relative to skb->head, triggering the truncation and subsequent oversized read in batadv_mcast_forw_packet().

No verified public exploit code is available. See the upstream patches referenced below for the exact call paths and validation logic.

Detection Methods for CVE-2026-80839

Indicators of Compromise

Kernel oops or KASAN out-of-bounds read reports referencing batadv_mcast_forw_packet or batadv_tvlv_call_handler
Unexpected crashes of nodes running the batman-adv module after receiving mesh traffic
Malformed multicast TVLV frames observed on mesh interfaces with length fields near or exceeding 65535

Detection Strategies

Enable KASAN on test kernels to catch the out-of-bounds read at the source rather than at a downstream crash site
Monitor dmesg and kernel telemetry for stack traces containing batadv_ symbols on mesh nodes
Capture and inspect mesh traffic with tcpdump on bat0 interfaces to identify oversized or malformed TVLV containers

Monitoring Recommendations

Forward kernel logs from mesh nodes to a central data lake and alert on batadv fault signatures
Track kernel version inventory across mesh-enabled devices to identify unpatched hosts
Baseline normal multicast TVLV sizes on the mesh so that anomalous, oversized frames stand out

How to Mitigate CVE-2026-80839

Immediate Actions Required

Update to a Linux kernel that includes the fix commits referenced by the upstream stable tree
Rebuild and redeploy embedded firmware images (for example, OpenWrt) once the patched batman-adv module is available
Restrict mesh participation to trusted nodes where possible, using authenticated links or physical segmentation

Patch Information

The fix introduces skb_set_transport_header_careful(), an offset-aware counterpart to skb_reset_transport_header_careful(), which validates the final head-relative offset before assigning it. batadv_tvlv_call_handler() now uses the new helper and rejects unrepresentable TVLVs before setting the network header. See the upstream commits: Kernel Git Commit 1b46674, Kernel Git Commit 2b46baa, Kernel Git Commit 916ec74, Kernel Git Commit da1f5aa, and Kernel Git Commit f12c2de.

Workarounds

Unload the batman-adv module on hosts that do not require mesh networking with modprobe -r batman_adv
Blacklist the module in /etc/modprobe.d/ on systems where mesh functionality is not needed
Isolate mesh interfaces from untrusted peers via link-layer filtering or encrypted overlays until the patched kernel is deployed

bash

# Disable the batman-adv module where mesh networking is not required
sudo modprobe -r batman_adv
echo 'blacklist batman_adv' | sudo tee /etc/modprobe.d/blacklist-batman-adv.conf

# Verify the running kernel includes the fix after upgrade
uname -r