CVE-2026-64088

What it actually does

This vulnerability is a signed integer wraparound/type-confusion flaw in the Linux kernel B.A.T.M.A.N. Advanced (batman-adv) mesh networking subsystem. The translation-table buffer length field is stored as a signed 16-bit value even though it should never be negative. When the value exceeds 32767, it can wrap to a negative number and later be sign-extended into a larger integer. During translation-table response generation, this can cause the kernel to allocate a larger response buffer than it actually initializes, resulting in uninitialized kernel memory being included in network responses. The primary technical risk is adjacent-network disclosure of kernel memory from systems using batman-adv; leaked memory may contain sensitive data or information useful for follow-on exploitation such as kernel address disclosures.

Why it matters to the business

Systems that participate in batman-adv mesh networks could unintentionally disclose sensitive kernel memory to another node on the same mesh or adjacent Layer 2 segment. In operational terms, this can expose confidential data, weaken kernel exploit mitigations, and increase the likelihood of successful follow-on attacks against network appliances, embedded Linux devices, routers, IoT gateways, or custom mesh deployments. The CVSS score is high, but the practical exposure is limited to environments where the batman-adv kernel module is present, enabled, and reachable from an attacker on the relevant mesh/adjacent network. EPSS is currently low and it is not listed in CISA KEV, so prioritize based on whether batman-adv is deployed in production or exposed in untrusted wireless/mesh environments.

How an attack unfolds

An attacker first needs access to the same batman-adv mesh network or adjacent Layer 2 domain as a vulnerable Linux system. The attacker interacts with the batman-adv translation-table protocol and influences conditions that cause a translation-table buffer length greater than the signed 16-bit maximum. On the vulnerable system, that value wraps into a negative signed integer and is later treated incorrectly when preparing a translation-table response. The kernel allocates a response buffer larger than the initialized data and transmits portions of uninitialized memory back over the mesh protocol. The attacker captures the response packets and analyzes the leaked bytes for kernel pointers, heap contents, credentials, or other sensitive artifacts that can support reconnaissance or a subsequent exploit chain.

How to fix it

Upgrade the Linux kernel to a version that includes the upstream fix for "batman-adv: tt: fix negative tt_buff_len". Because no product-specific fixed versions were provided, use the fixed kernel packages from the operating system or device vendor and confirm that the batman-adv patch is included in the changelog or source. Where immediate patching is not possible, reduce exposure by disabling the batman-adv module if it is not required, removing batman-adv interfaces, blocking untrusted access to mesh networks, and restricting mesh participation to authenticated/trusted nodes. On systems where batman-adv is built as a loadable module, prevent loading the module if unused; on embedded or appliance systems, obtain updated firmware from the vendor.

How to confirm the fix worked

Confirm remediation by verifying that the running kernel package includes the batman-adv fix and that the system has been rebooted into the patched kernel. Check whether the batman-adv module is loaded using commands such as `lsmod | grep batman_adv`, `modinfo batman_adv`, or by inspecting `/sys/module/batman_adv`. Validate exposure by confirming whether any batman-adv interfaces exist, for example with `ip link` or `batctl if` where batctl is installed. For source-based or vendor kernels, confirm that `tt_buff_len` in the relevant batman-adv structures is unsigned rather than signed and that the patch titled `batman-adv: tt: fix negative tt_buff_len` is present. If batman-adv is not loaded, no mesh interfaces exist, and module loading is disabled or unavailable, practical exposure is significantly reduced.

Typical attack path

1. Identify Linux systems participating in a B.A.T.M.A.N. Advanced mesh network.
2. Gain access to the same mesh or adjacent Layer 2 network segment.
3. Send or trigger batman-adv translation-table activity that causes an oversized translation-table buffer length condition.
4. Receive malformed or oversized translation-table response data from the vulnerable system.
5. Extract uninitialized kernel memory from the response payload.
6. Use leaked memory contents for sensitive-data recovery, kernel address discovery, or preparation of follow-on attacks.

How to detect it

Retrospective detection is difficult because exploitation may only appear as batman-adv protocol traffic and may not generate kernel logs. Focus on systems where batman-adv is enabled and review packet captures, network telemetry, and mesh-management logs for unusual translation-table request or response behavior, oversized TT response payloads, repeated interactions from unknown mesh nodes, or newly observed mesh participants. Useful sources include full-packet capture on mesh interfaces, Zeek/Suricata metadata where custom EtherType visibility is available, wireless mesh controller logs, `batctl` output/history if collected, system logs for module load events, and EDR/Linux audit data showing `batman_adv` module loading. Because the likely artifact is data leakage over the mesh protocol rather than code execution, absence of process creation or authentication logs does not rule out exploitation. If sensitive exposure is suspected, preserve packet captures and memory/host forensic images from affected mesh nodes before rebooting where operationally feasible.

• batman_adv
• batman-adv
• /sys/module/batman_adv
• /sys/class/net/bat0
• EtherType 0x4305
• BATADV_TT_REQUEST
• BATADV_TT_RESPONSE
• batctl if
• batctl n
• batctl tg

What your security team should do

• Inventory Linux systems, network appliances, embedded devices, routers, and IoT gateways that use the batman-adv kernel module or participate in B.A.T.M.A.N. Advanced mesh networks.
• Patch exposed or production mesh nodes first, especially devices on wireless, field, shared, or otherwise untrusted mesh networks.
• If batman-adv is not required, disable or blacklist the `batman_adv` module and remove related mesh interfaces.
• Restrict mesh network membership to trusted nodes and monitor for unknown participants or unexpected translation-table activity.
• Capture and review batman-adv traffic in sensitive deployments for unusually large or malformed translation-table responses.
• Coordinate with device and Linux distribution vendors for fixed kernel or firmware releases where the kernel is vendor-maintained.
• After patching, reboot systems into the fixed kernel and verify that the vulnerable module is no longer running.