CVE-2026-64089
batman-adv: tt: fix negative last_changeset_len
Description
In the Linux kernel, the following vulnerability has been resolved: batman-adv: tt: fix negative last_changeset_len batadv_piv_tt::last_changeset_len len was declared as s16, but the field is never intended to hold a negative value. When a value greater than 32767 is assigned, it wraps to a negative signed integer. In batadv_send_my_tt_response(), last_changeset_len is temporarily widened to s32. The incorrectly negative s16 value propagates into the s32, causing batadv_tt_prepare_tvlv_local_data() to allocate a full sized buffer but populates only a small portion of it with the collected changeset. All remaining bits are kept uninitialized. Using an u16 avoids this type confusion and ensures that no (negative) sign extension is performed in batadv_send_my_tt_response().
INFO
Published Date :
July 19, 2026, 4:17 p.m.
Last Modified :
July 19, 2026, 4:17 p.m.
Remotely Exploit :
No
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Affected Products
The following products are affected by CVE-2026-64089
vulnerability.
Even if cvefeed.io is aware of the exact versions of the
products
that
are
affected, the information is not represented in the table below.
No affected product recoded yet
Solution
- Update the Linux kernel to the patched version.
- Verify the integrity of the kernel build.
- Reboot the system after updating.
- Monitor system stability post-update.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-64089.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-64089 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-64089
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-64089 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-64089 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jul. 19, 2026
Action Type Old Value New Value Added Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': 'a73105b8d4c765d9ebfb664d0a66802127d8e4c7', 'lessThan': '6314089acf0ddf64376fdc0b1420695504c73f52', 'versionType': 'git'}, {'status': 'affected', 'version': 'a73105b8d4c765d9ebfb664d0a66802127d8e4c7', 'lessThan': '55dc41fe8821e9a849e147255ad572bc933a9d15', 'versionType': 'git'}, {'status': 'affected', 'version': 'a73105b8d4c765d9ebfb664d0a66802127d8e4c7', 'lessThan': 'c424e8519ac78eac5d9f4eecf06208a0d619ec14', 'versionType': 'git'}, {'status': 'affected', 'version': 'a73105b8d4c765d9ebfb664d0a66802127d8e4c7', 'lessThan': '22d59c72f4a47ffec121d0610f70d0d70c3c11c8', 'versionType': 'git'}, {'status': 'affected', 'version': 'a73105b8d4c765d9ebfb664d0a66802127d8e4c7', 'lessThan': 'eb235472b52ef36981c5aad330485eaf2382c53b', 'versionType': 'git'}, {'status': 'affected', 'version': 'a73105b8d4c765d9ebfb664d0a66802127d8e4c7', 'lessThan': '179eb62506a02d00370bd6478898cb632e10986c', 'versionType': 'git'}, {'status': 'affected', 'version': 'a73105b8d4c765d9ebfb664d0a66802127d8e4c7', 'lessThan': 'd29abf70c665730e249d2ec8e1402095ae26bcee', 'versionType': 'git'}, {'status': 'affected', 'version': 'a73105b8d4c765d9ebfb664d0a66802127d8e4c7', 'lessThan': 'fc92cdfcb295cefa4344d71a527d61b638b7bfc4', 'versionType': 'git'}], 'programFiles': ['net/batman-adv/types.h'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '3.1'}, {'status': 'unaffected', 'version': '0', 'lessThan': '3.1', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '5.10.258', 'versionType': 'semver', 'lessThanOrEqual': '5.10.*'}, {'status': 'unaffected', 'version': '5.15.209', 'versionType': 'semver', 'lessThanOrEqual': '5.15.*'}, {'status': 'unaffected', 'version': '6.1.175', 'versionType': 'semver', 'lessThanOrEqual': '6.1.*'}, {'status': 'unaffected', 'version': '6.6.142', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.92', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.34', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.0.11', 'versionType': 'semver', 'lessThanOrEqual': '7.0.*'}, {'status': 'unaffected', 'version': '7.1', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['net/batman-adv/types.h'], 'defaultStatus': 'affected'}] Added Description In the Linux kernel, the following vulnerability has been resolved: batman-adv: tt: fix negative last_changeset_len batadv_piv_tt::last_changeset_len len was declared as s16, but the field is never intended to hold a negative value. When a value greater than 32767 is assigned, it wraps to a negative signed integer. In batadv_send_my_tt_response(), last_changeset_len is temporarily widened to s32. The incorrectly negative s16 value propagates into the s32, causing batadv_tt_prepare_tvlv_local_data() to allocate a full sized buffer but populates only a small portion of it with the collected changeset. All remaining bits are kept uninitialized. Using an u16 avoids this type confusion and ensures that no (negative) sign extension is performed in batadv_send_my_tt_response(). Added Reference https://git.kernel.org/stable/c/179eb62506a02d00370bd6478898cb632e10986c Added Reference https://git.kernel.org/stable/c/22d59c72f4a47ffec121d0610f70d0d70c3c11c8 Added Reference https://git.kernel.org/stable/c/55dc41fe8821e9a849e147255ad572bc933a9d15 Added Reference https://git.kernel.org/stable/c/6314089acf0ddf64376fdc0b1420695504c73f52 Added Reference https://git.kernel.org/stable/c/c424e8519ac78eac5d9f4eecf06208a0d619ec14 Added Reference https://git.kernel.org/stable/c/d29abf70c665730e249d2ec8e1402095ae26bcee Added Reference https://git.kernel.org/stable/c/eb235472b52ef36981c5aad330485eaf2382c53b Added Reference https://git.kernel.org/stable/c/fc92cdfcb295cefa4344d71a527d61b638b7bfc4