CVE-2026-64088
batman-adv: tt: fix negative tt_buff_len
Description
In the Linux kernel, the following vulnerability has been resolved: batman-adv: tt: fix negative tt_buff_len batadv_orig_node::tt_buff_len was declared as s16, but the field is never intended to hold a negative value. When a value greater than 32767 is assigned, it wraps to a negative signed integer. In batadv_send_other_tt_response(), tt_buff_len is temporarily widened to s32. The incorrectly negative s16 value propagates into the s32, causing batadv_tt_prepare_tvlv_global_data() to allocate a full sized buffer but populates only a small portion of it with the collected changeset. All remaining bits are kept uninitialized. Using an u16 avoids this type confusion and ensures that no (negative) sign extension is performed in batadv_send_other_tt_response().
INFO
Published Date :
July 19, 2026, 4:17 p.m.
Last Modified :
July 19, 2026, 4:17 p.m.
Remotely Exploit :
No
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Affected Products
The following products are affected by CVE-2026-64088
vulnerability.
Even if cvefeed.io is aware of the exact versions of the
products
that
are
affected, the information is not represented in the table below.
No affected product recoded yet
Solution
- Update the Linux kernel.
- Ensure tt_buff_len uses unsigned integers.
- Review integer type usage for buffer management.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-64088.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-64088 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-64088
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-64088 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-64088 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jul. 19, 2026
Action Type Old Value New Value Added Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': 'a73105b8d4c765d9ebfb664d0a66802127d8e4c7', 'lessThan': '4c4c2f340f4c27373bfcac8dc5032ce7bb474e47', 'versionType': 'git'}, {'status': 'affected', 'version': 'a73105b8d4c765d9ebfb664d0a66802127d8e4c7', 'lessThan': '33e5ede7ce6d92e531920d4bbd6d3e18ef1c6430', 'versionType': 'git'}, {'status': 'affected', 'version': 'a73105b8d4c765d9ebfb664d0a66802127d8e4c7', 'lessThan': '3c96dff00998314983b68a3e7caac07a66ebe496', 'versionType': 'git'}, {'status': 'affected', 'version': 'a73105b8d4c765d9ebfb664d0a66802127d8e4c7', 'lessThan': '32edd2a28e112064020a2f319a8cb8a9e5a09767', 'versionType': 'git'}, {'status': 'affected', 'version': 'a73105b8d4c765d9ebfb664d0a66802127d8e4c7', 'lessThan': '4dab98961426d0cf6a1599cda6950b7596ca2fcd', 'versionType': 'git'}, {'status': 'affected', 'version': 'a73105b8d4c765d9ebfb664d0a66802127d8e4c7', 'lessThan': '730de8733dd90f70d7580a9b329b971f8e1474a2', 'versionType': 'git'}, {'status': 'affected', 'version': 'a73105b8d4c765d9ebfb664d0a66802127d8e4c7', 'lessThan': 'ed28ead3420c373a7928622f114bc6168075d1e1', 'versionType': 'git'}, {'status': 'affected', 'version': 'a73105b8d4c765d9ebfb664d0a66802127d8e4c7', 'lessThan': 'b64963a2ceeb7529310b6cf253a1e540784422f4', 'versionType': 'git'}], 'programFiles': ['net/batman-adv/types.h'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '3.1'}, {'status': 'unaffected', 'version': '0', 'lessThan': '3.1', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '5.10.258', 'versionType': 'semver', 'lessThanOrEqual': '5.10.*'}, {'status': 'unaffected', 'version': '5.15.209', 'versionType': 'semver', 'lessThanOrEqual': '5.15.*'}, {'status': 'unaffected', 'version': '6.1.175', 'versionType': 'semver', 'lessThanOrEqual': '6.1.*'}, {'status': 'unaffected', 'version': '6.6.142', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.92', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.34', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.0.11', 'versionType': 'semver', 'lessThanOrEqual': '7.0.*'}, {'status': 'unaffected', 'version': '7.1', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['net/batman-adv/types.h'], 'defaultStatus': 'affected'}] Added Description In the Linux kernel, the following vulnerability has been resolved: batman-adv: tt: fix negative tt_buff_len batadv_orig_node::tt_buff_len was declared as s16, but the field is never intended to hold a negative value. When a value greater than 32767 is assigned, it wraps to a negative signed integer. In batadv_send_other_tt_response(), tt_buff_len is temporarily widened to s32. The incorrectly negative s16 value propagates into the s32, causing batadv_tt_prepare_tvlv_global_data() to allocate a full sized buffer but populates only a small portion of it with the collected changeset. All remaining bits are kept uninitialized. Using an u16 avoids this type confusion and ensures that no (negative) sign extension is performed in batadv_send_other_tt_response(). Added Reference https://git.kernel.org/stable/c/32edd2a28e112064020a2f319a8cb8a9e5a09767 Added Reference https://git.kernel.org/stable/c/33e5ede7ce6d92e531920d4bbd6d3e18ef1c6430 Added Reference https://git.kernel.org/stable/c/3c96dff00998314983b68a3e7caac07a66ebe496 Added Reference https://git.kernel.org/stable/c/4c4c2f340f4c27373bfcac8dc5032ce7bb474e47 Added Reference https://git.kernel.org/stable/c/4dab98961426d0cf6a1599cda6950b7596ca2fcd Added Reference https://git.kernel.org/stable/c/730de8733dd90f70d7580a9b329b971f8e1474a2 Added Reference https://git.kernel.org/stable/c/b64963a2ceeb7529310b6cf253a1e540784422f4 Added Reference https://git.kernel.org/stable/c/ed28ead3420c373a7928622f114bc6168075d1e1