CVE-2026-31659
Description
In the Linux kernel, the following vulnerability has been resolved: batman-adv: reject oversized global TT response buffers batadv_tt_prepare_tvlv_global_data() builds the allocation length for a global TT response in 16-bit temporaries. When a remote originator advertises a large enough global TT, the TT payload length plus the VLAN header offset can exceed 65535 and wrap before kmalloc(). The full-table response path still uses the original TT payload length when it fills tt_change, so the wrapped allocation is too small and batadv_tt_prepare_tvlv_global_data() writes past the end of the heap object before the later packet-size check runs. Fix this by rejecting TT responses whose TVLV value length cannot fit in the 16-bit TVLV payload length field.
Predictions
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
Vendor advisory: debian — https://security-tracker.debian.org/tracker/CVE-2026-31659
Vendor advisory: suse — https://www.suse.com/security/cve/CVE-2026-31659.html
Vendor advisory: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 — https://git.kernel.org/stable/c/f970646b9a39539d1bac86822ac78b5915455ea9
Vendor advisory: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 — https://git.kernel.org/stable/c/de6c1dc3c7d01a152607e6fcecee4d5288283f10
Vendor advisory: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 — https://git.kernel.org/stable/c/cf2199171ef799ca7270019125f4a91bd20ad4d9
Vendor advisory: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 — https://git.kernel.org/stable/c/95c71365a2222908441b54d6f2c315e0c79fcec3
Vendor advisory: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 — https://git.kernel.org/stable/c/7e5d007e0df946bffb8542fb112e0044014a5897
Vendor advisory: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 — https://git.kernel.org/stable/c/69d61639bc7e963c3b645e570279d731e7c89062
Vendor advisory: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 — https://git.kernel.org/stable/c/3a359bf5c61d52e7f09754108309d637532164a6
Vendor advisory: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 — https://git.kernel.org/stable/c/2997f4bd1f982e7013709946e00be89b507693fa
OS impact
| OS | Version | Status | Fixed in |
|---|---|---|---|
| sles | affected | | |
| debian | bookworm | fixed | 6.1.170-1 |
| debian | forky | fixed | 6.19.13-1 |
| debian | sid | fixed | 6.19.13-1 |
| debian | trixie | fixed | 6.12.85-1 |
| debian | bullseye | fixed | 6.1.170-1~deb11u1 |
| linux-kernel | affected | 5.10.253 | |
| linux-kernel | 3.13 | affected | |
| linux-kernel | 7.0 | affected | |
References
- https://git.kernel.org/stable/c/2997f4bd1f982e7013709946e00be89b507693fa
- https://git.kernel.org/stable/c/3a359bf5c61d52e7f09754108309d637532164a6
- https://git.kernel.org/stable/c/69d61639bc7e963c3b645e570279d731e7c89062
- https://git.kernel.org/stable/c/7e5d007e0df946bffb8542fb112e0044014a5897
- https://git.kernel.org/stable/c/95c71365a2222908441b54d6f2c315e0c79fcec3
- https://git.kernel.org/stable/c/cf2199171ef799ca7270019125f4a91bd20ad4d9
- https://git.kernel.org/stable/c/de6c1dc3c7d01a152607e6fcecee4d5288283f10
- https://git.kernel.org/stable/c/f970646b9a39539d1bac86822ac78b5915455ea9
- https://www.suse.com/security/cve/CVE-2026-31659.html
- https://security-tracker.debian.org/tracker/CVE-2026-31659
Verify integrity in audit chain (admin only). AS-IS.