CVE-2026-64089
In the Linux kernel’s batman-adv networking component, a signed 16‑bit field was incorrectly used to store a value that could exceed its maximum, causing negative sign extension and leaving large portions of a buffer uninitialized. This flaw could allow an attacker to read or corrupt memory when the kernel processes certain network packets. The issue has been fixed in a kernel update that replaces the signed field with an unsigned 16‑bit type.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Linux kernel users running batman-adv on an unpatched kernel version. All distributions that ship the affected kernel build are potentially impacted.
Real-world impact
An attacker could exploit the uninitialized memory to read sensitive data or corrupt memory, potentially leading to a full system compromise or denial of service.
Why this severity
The CVSS score of 9.8 reflects that the vulnerability can be exploited over the network without authentication or user interaction, and it can compromise confidentiality, integrity, and availability of the affected system.
What to do about it
- 01Upgrade the Linux kernel to a version that includes the batman-adv patch correcting the negative last_changeset_len issue.
NVD-referenced vendor advisory
Timeline
- Jul 19, 2026 · 14d agoPublishedDisclosed and added to the National Vulnerability Database.
- Jul 20, 2026 · 13d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.
- Jul 30, 2026 · 3d agoAdvisory updatedThe NVD record was last revised.
How it’s attacked
References & advisories
- git.kernel.org/stable/c/179eb62506a02d0037…
- git.kernel.org/stable/c/22d59c72f4a47ffec1…
- git.kernel.org/stable/c/55dc41fe8821e9a849…
- git.kernel.org/stable/c/6314089acf0ddf6437…
- git.kernel.org/stable/c/c424e8519ac78eac5d…
- git.kernel.org/stable/c/d29abf70c665730e24…
- git.kernel.org/stable/c/eb235472b52ef36981…
- git.kernel.org/stable/c/fc92cdfcb295cefa43…