0.0
NA
CVE-2026-64088
batman-adv: tt: fix negative tt_buff_len
Description

In the Linux kernel, the following vulnerability has been resolved: batman-adv: tt: fix negative tt_buff_len batadv_orig_node::tt_buff_len was declared as s16, but the field is never intended to hold a negative value. When a value greater than 32767 is assigned, it wraps to a negative signed integer. In batadv_send_other_tt_response(), tt_buff_len is temporarily widened to s32. The incorrectly negative s16 value propagates into the s32, causing batadv_tt_prepare_tvlv_global_data() to allocate a full sized buffer but populates only a small portion of it with the collected changeset. All remaining bits are kept uninitialized. Using an u16 avoids this type confusion and ensures that no (negative) sign extension is performed in batadv_send_other_tt_response().

INFO

Published Date :

July 19, 2026, 4:17 p.m.

Last Modified :

July 19, 2026, 4:17 p.m.

Remotely Exploit :

No

Source :

416baaa9-dc9f-4396-8d5f-8c081fb06d67
Affected Products

The following products are affected by CVE-2026-64088 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

No affected product recoded yet

Solution
Update Linux kernel to resolve integer overflow and uninitialized memory buffer issues.
  • Update the Linux kernel.
  • Ensure tt_buff_len uses unsigned integers.
  • Review integer type usage for buffer management.
CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2026-64088 is associated with the following CWEs:

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2026-64088 weaknesses.

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2026-64088 vulnerability anywhere in the article.

The following table lists the changes that have been made to the CVE-2026-64088 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.

  • New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67

    Jul. 19, 2026

    Action Type Old Value New Value
    Added Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': 'a73105b8d4c765d9ebfb664d0a66802127d8e4c7', 'lessThan': '4c4c2f340f4c27373bfcac8dc5032ce7bb474e47', 'versionType': 'git'}, {'status': 'affected', 'version': 'a73105b8d4c765d9ebfb664d0a66802127d8e4c7', 'lessThan': '33e5ede7ce6d92e531920d4bbd6d3e18ef1c6430', 'versionType': 'git'}, {'status': 'affected', 'version': 'a73105b8d4c765d9ebfb664d0a66802127d8e4c7', 'lessThan': '3c96dff00998314983b68a3e7caac07a66ebe496', 'versionType': 'git'}, {'status': 'affected', 'version': 'a73105b8d4c765d9ebfb664d0a66802127d8e4c7', 'lessThan': '32edd2a28e112064020a2f319a8cb8a9e5a09767', 'versionType': 'git'}, {'status': 'affected', 'version': 'a73105b8d4c765d9ebfb664d0a66802127d8e4c7', 'lessThan': '4dab98961426d0cf6a1599cda6950b7596ca2fcd', 'versionType': 'git'}, {'status': 'affected', 'version': 'a73105b8d4c765d9ebfb664d0a66802127d8e4c7', 'lessThan': '730de8733dd90f70d7580a9b329b971f8e1474a2', 'versionType': 'git'}, {'status': 'affected', 'version': 'a73105b8d4c765d9ebfb664d0a66802127d8e4c7', 'lessThan': 'ed28ead3420c373a7928622f114bc6168075d1e1', 'versionType': 'git'}, {'status': 'affected', 'version': 'a73105b8d4c765d9ebfb664d0a66802127d8e4c7', 'lessThan': 'b64963a2ceeb7529310b6cf253a1e540784422f4', 'versionType': 'git'}], 'programFiles': ['net/batman-adv/types.h'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '3.1'}, {'status': 'unaffected', 'version': '0', 'lessThan': '3.1', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '5.10.258', 'versionType': 'semver', 'lessThanOrEqual': '5.10.*'}, {'status': 'unaffected', 'version': '5.15.209', 'versionType': 'semver', 'lessThanOrEqual': '5.15.*'}, {'status': 'unaffected', 'version': '6.1.175', 'versionType': 'semver', 'lessThanOrEqual': '6.1.*'}, {'status': 'unaffected', 'version': '6.6.142', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.92', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.34', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.0.11', 'versionType': 'semver', 'lessThanOrEqual': '7.0.*'}, {'status': 'unaffected', 'version': '7.1', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['net/batman-adv/types.h'], 'defaultStatus': 'affected'}]
    Added Description In the Linux kernel, the following vulnerability has been resolved: batman-adv: tt: fix negative tt_buff_len batadv_orig_node::tt_buff_len was declared as s16, but the field is never intended to hold a negative value. When a value greater than 32767 is assigned, it wraps to a negative signed integer. In batadv_send_other_tt_response(), tt_buff_len is temporarily widened to s32. The incorrectly negative s16 value propagates into the s32, causing batadv_tt_prepare_tvlv_global_data() to allocate a full sized buffer but populates only a small portion of it with the collected changeset. All remaining bits are kept uninitialized. Using an u16 avoids this type confusion and ensures that no (negative) sign extension is performed in batadv_send_other_tt_response().
    Added Reference https://git.kernel.org/stable/c/32edd2a28e112064020a2f319a8cb8a9e5a09767
    Added Reference https://git.kernel.org/stable/c/33e5ede7ce6d92e531920d4bbd6d3e18ef1c6430
    Added Reference https://git.kernel.org/stable/c/3c96dff00998314983b68a3e7caac07a66ebe496
    Added Reference https://git.kernel.org/stable/c/4c4c2f340f4c27373bfcac8dc5032ce7bb474e47
    Added Reference https://git.kernel.org/stable/c/4dab98961426d0cf6a1599cda6950b7596ca2fcd
    Added Reference https://git.kernel.org/stable/c/730de8733dd90f70d7580a9b329b971f8e1474a2
    Added Reference https://git.kernel.org/stable/c/b64963a2ceeb7529310b6cf253a1e540784422f4
    Added Reference https://git.kernel.org/stable/c/ed28ead3420c373a7928622f114bc6168075d1e1
EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days. Following chart shows the EPSS score history of the vulnerability.