0.0
NA
CVE-2026-64089
batman-adv: tt: fix negative last_changeset_len
Description

In the Linux kernel, the following vulnerability has been resolved: batman-adv: tt: fix negative last_changeset_len batadv_piv_tt::last_changeset_len len was declared as s16, but the field is never intended to hold a negative value. When a value greater than 32767 is assigned, it wraps to a negative signed integer. In batadv_send_my_tt_response(), last_changeset_len is temporarily widened to s32. The incorrectly negative s16 value propagates into the s32, causing batadv_tt_prepare_tvlv_local_data() to allocate a full sized buffer but populates only a small portion of it with the collected changeset. All remaining bits are kept uninitialized. Using an u16 avoids this type confusion and ensures that no (negative) sign extension is performed in batadv_send_my_tt_response().

INFO

Published Date :

July 19, 2026, 4:17 p.m.

Last Modified :

July 19, 2026, 4:17 p.m.

Remotely Exploit :

No

Source :

416baaa9-dc9f-4396-8d5f-8c081fb06d67
Affected Products

The following products are affected by CVE-2026-64089 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

No affected product recoded yet

Solution
Update Linux kernel to fix integer type confusion leading to buffer over-read and uninitialized memory.
  • Update the Linux kernel to the patched version.
  • Verify the integrity of the kernel build.
  • Reboot the system after updating.
  • Monitor system stability post-update.
CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2026-64089 is associated with the following CWEs:

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2026-64089 weaknesses.

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2026-64089 vulnerability anywhere in the article.

The following table lists the changes that have been made to the CVE-2026-64089 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.

  • New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67

    Jul. 19, 2026

    Action Type Old Value New Value
    Added Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': 'a73105b8d4c765d9ebfb664d0a66802127d8e4c7', 'lessThan': '6314089acf0ddf64376fdc0b1420695504c73f52', 'versionType': 'git'}, {'status': 'affected', 'version': 'a73105b8d4c765d9ebfb664d0a66802127d8e4c7', 'lessThan': '55dc41fe8821e9a849e147255ad572bc933a9d15', 'versionType': 'git'}, {'status': 'affected', 'version': 'a73105b8d4c765d9ebfb664d0a66802127d8e4c7', 'lessThan': 'c424e8519ac78eac5d9f4eecf06208a0d619ec14', 'versionType': 'git'}, {'status': 'affected', 'version': 'a73105b8d4c765d9ebfb664d0a66802127d8e4c7', 'lessThan': '22d59c72f4a47ffec121d0610f70d0d70c3c11c8', 'versionType': 'git'}, {'status': 'affected', 'version': 'a73105b8d4c765d9ebfb664d0a66802127d8e4c7', 'lessThan': 'eb235472b52ef36981c5aad330485eaf2382c53b', 'versionType': 'git'}, {'status': 'affected', 'version': 'a73105b8d4c765d9ebfb664d0a66802127d8e4c7', 'lessThan': '179eb62506a02d00370bd6478898cb632e10986c', 'versionType': 'git'}, {'status': 'affected', 'version': 'a73105b8d4c765d9ebfb664d0a66802127d8e4c7', 'lessThan': 'd29abf70c665730e249d2ec8e1402095ae26bcee', 'versionType': 'git'}, {'status': 'affected', 'version': 'a73105b8d4c765d9ebfb664d0a66802127d8e4c7', 'lessThan': 'fc92cdfcb295cefa4344d71a527d61b638b7bfc4', 'versionType': 'git'}], 'programFiles': ['net/batman-adv/types.h'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '3.1'}, {'status': 'unaffected', 'version': '0', 'lessThan': '3.1', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '5.10.258', 'versionType': 'semver', 'lessThanOrEqual': '5.10.*'}, {'status': 'unaffected', 'version': '5.15.209', 'versionType': 'semver', 'lessThanOrEqual': '5.15.*'}, {'status': 'unaffected', 'version': '6.1.175', 'versionType': 'semver', 'lessThanOrEqual': '6.1.*'}, {'status': 'unaffected', 'version': '6.6.142', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.92', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.34', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.0.11', 'versionType': 'semver', 'lessThanOrEqual': '7.0.*'}, {'status': 'unaffected', 'version': '7.1', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['net/batman-adv/types.h'], 'defaultStatus': 'affected'}]
    Added Description In the Linux kernel, the following vulnerability has been resolved: batman-adv: tt: fix negative last_changeset_len batadv_piv_tt::last_changeset_len len was declared as s16, but the field is never intended to hold a negative value. When a value greater than 32767 is assigned, it wraps to a negative signed integer. In batadv_send_my_tt_response(), last_changeset_len is temporarily widened to s32. The incorrectly negative s16 value propagates into the s32, causing batadv_tt_prepare_tvlv_local_data() to allocate a full sized buffer but populates only a small portion of it with the collected changeset. All remaining bits are kept uninitialized. Using an u16 avoids this type confusion and ensures that no (negative) sign extension is performed in batadv_send_my_tt_response().
    Added Reference https://git.kernel.org/stable/c/179eb62506a02d00370bd6478898cb632e10986c
    Added Reference https://git.kernel.org/stable/c/22d59c72f4a47ffec121d0610f70d0d70c3c11c8
    Added Reference https://git.kernel.org/stable/c/55dc41fe8821e9a849e147255ad572bc933a9d15
    Added Reference https://git.kernel.org/stable/c/6314089acf0ddf64376fdc0b1420695504c73f52
    Added Reference https://git.kernel.org/stable/c/c424e8519ac78eac5d9f4eecf06208a0d619ec14
    Added Reference https://git.kernel.org/stable/c/d29abf70c665730e249d2ec8e1402095ae26bcee
    Added Reference https://git.kernel.org/stable/c/eb235472b52ef36981c5aad330485eaf2382c53b
    Added Reference https://git.kernel.org/stable/c/fc92cdfcb295cefa4344d71a527d61b638b7bfc4
EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days. Following chart shows the EPSS score history of the vulnerability.