CVE-2026-46198

What it actually does

This vulnerability is an integer overflow in the Linux kernel B.A.T.M.A.N. Advanced mesh networking component, specifically in the OGM aggregation/send path. A size check uses an int while the packet buffer position is tracked with an s16, allowing the buffer position to wrap under crafted conditions. If a vulnerable host processes malicious adjacent-network B.A.T.M.A.N. Advanced traffic, the kernel may perform an out-of-bounds read. Depending on kernel configuration, memory layout, and hardening features, this can cause kernel memory disclosure, crashes, or potentially support further exploitation of kernel memory corruption paths.

Why it matters to the business

Systems using Linux kernel B.A.T.M.A.N. Advanced mesh networking may be exposed to unauthenticated attacks from the same Layer 2 or mesh-adjacent network. Successful exploitation could disrupt network nodes, expose sensitive kernel memory, or contribute to a broader compromise of infrastructure that relies on mesh networking. The vulnerability has a high CVSS score but currently has low EPSS, no known public exploit maturity, and is not listed in CISA KEV, so urgency is highest for systems with batman-adv enabled or deployed in wireless, IoT, industrial, lab, or mesh-routing environments.

How an attack unfolds

An attacker first needs adjacency to a network segment where B.A.T.M.A.N. Advanced traffic is accepted, such as a mesh network, bridge, wireless backhaul, or test environment with the batman-adv kernel module active. The attacker crafts B.A.T.M.A.N. Advanced OGM aggregation traffic designed to drive the packet buffer position calculation past the range of the signed 16-bit buff_pos variable while still satisfying the broader integer size check. When the vulnerable kernel processes the crafted packet in the batadv_iv_ogm_send_to_if path, the wrapped buffer position can cause an out-of-bounds read. The observable outcome may be a kernel warning, KASAN report, kernel oops, denial of service, or possible exposure of adjacent kernel memory. There are no named threat actors or confirmed exploitation campaigns reported for this issue in the provided data.

How to fix it

Apply a Linux kernel update that includes the upstream batman-adv fix for the buff_pos integer overflow in batadv_iv_ogm_send_to_if. Because no exact fixed package versions were provided, use distribution vendor advisories and kernel changelogs to identify patched kernel builds for each deployed distribution. Prioritize systems where the batman_adv module is loaded, bat0 or other batman-adv interfaces exist, or B.A.T.M.A.N. Advanced mesh networking is intentionally enabled. If immediate patching is not possible, disable or unload the batman_adv kernel module where not required, blacklist it from loading, remove batman-adv interfaces, and restrict Layer 2 access to mesh interfaces so only trusted peers can exchange batman-adv frames. Network segmentation, wireless access controls, and filtering of unexpected ethertype 0x4305 traffic can reduce exposure but should not be treated as a substitute for patching.

How to confirm the fix worked

Confirm remediation by verifying that affected systems are running a vendor kernel build that includes the batman-adv integer overflow fix. Review OS vendor security advisories and kernel package changelogs for references to CVE-2026-46198, batadv_iv_ogm_send_to_if, or the buff_pos overflow fix. Validate exposure by checking whether the batman_adv module is loaded, whether batman-adv interfaces such as bat0 exist, and whether /sys/module/batman_adv or /proc/net/batman_adv are present. After patching, reboot into the patched kernel where required and confirm uname -a, package manager output, and module metadata reflect the updated kernel. For mitigation-only cases, verify that batman_adv cannot be loaded and that no batman-adv interfaces are active.

Typical attack path

1. Identify a target Linux system or appliance participating in a B.A.T.M.A.N. Advanced mesh network.
2. Gain Layer 2 or mesh-adjacent network access where batman-adv frames can reach the target.
3. Send crafted B.A.T.M.A.N. Advanced OGM aggregation packets designed to trigger the buff_pos integer overflow.
4. Cause the vulnerable kernel to process the malformed packet in the batadv_iv_ogm_send_to_if code path.
5. Observe or leverage resulting kernel out-of-bounds read behavior, such as kernel crash, diagnostic leak, or memory-corruption side effects.

How to detect it

Retrospective exploitation detection is difficult because this issue is triggered by adjacent-network packet processing and may not leave application-level logs. Focus on kernel, system, and network telemetry. Review dmesg, journalctl, syslog, kernel crash dumps, and panic logs for kernel oops, KASAN, UBSAN, or slab out-of-bounds messages referencing batman-adv functions. Look for unexpected loading of the batman_adv module or unexpected creation of batman-adv interfaces. On networks where packet capture is available, search for unusual volumes or malformed B.A.T.M.A.N. Advanced frames, particularly Ethernet ethertype 0x4305, around the time of kernel instability. Correlate crashes or reboots of mesh nodes with spikes in batman-adv OGM traffic from unfamiliar MAC addresses. If crash dumps are available, inspect call traces for batadv_iv_ogm_send_to_if and batadv_iv_ogm_aggr_packet. Absence of these artifacts does not prove non-exploitation because failed or non-crashing attempts may not be logged.

• batadv_iv_ogm_send_to_if
• batadv_iv_ogm_aggr_packet
• batman-adv
• batman_adv
• /sys/module/batman_adv
• /proc/net/batman_adv
• bat0
• BUG: KASAN: slab-out-of-bounds
• BUG: KASAN: out-of-bounds
• kernel BUG at net/batman-adv
• Oops:
• ethertype 0x4305
• EtherType 0x4305
• B.A.T.M.A.N. Advanced

What your security team should do

• Inventory Linux systems and appliances for active batman-adv usage, including loaded batman_adv modules and bat0 interfaces.
• Patch exposed systems to a kernel version confirmed by the OS vendor to contain the batman-adv buff_pos overflow fix.
• Prioritize mesh, wireless, edge, IoT, lab, and embedded Linux deployments where adjacent attackers may be able to inject Layer 2 traffic.
• Disable or blacklist the batman_adv module on systems that do not require B.A.T.M.A.N. Advanced mesh networking.
• Restrict mesh network participation to trusted peers and monitor for unexpected ethertype 0x4305 traffic.
• Review kernel logs for crashes or sanitizer reports involving batadv_iv_ogm_send_to_if or batadv_iv_ogm_aggr_packet.
• Because the issue is not currently in KEV and EPSS is low, align broad enterprise rollout with normal kernel patch cycles, but treat confirmed batman-adv deployments as higher priority.