CVE-2026-64089

What it actually does

This vulnerability is an information disclosure flaw in the Linux kernel batman-adv subsystem. The issue is caused by a signed 16-bit length field used for the translation-table changeset length. When a value greater than 32767 is stored, it wraps into a negative value and is later sign-extended into a larger integer. During translation-table response generation, the kernel can allocate a large response buffer but populate only part of it, leaving the remainder uninitialized. That uninitialized kernel memory may then be transmitted in a batman-adv response, potentially exposing sensitive kernel heap contents to a network-adjacent attacker able to interact with the batman-adv mesh protocol.

Why it matters to the business

Systems using batman-adv for mesh networking could leak sensitive memory contents over the network. While the current EPSS score is low and there is no known CISA KEV listing or public exploit maturity reported, the high CVSS score means exposed deployments should still treat this as urgent, especially where batman-adv is enabled on production, embedded, industrial, wireless mesh, or edge devices. Successful exploitation could expose secrets or internal kernel data that help attackers plan follow-on compromise.

How an attack unfolds

An attacker first needs network access to a segment where batman-adv traffic is accepted, typically by being on or near the same mesh network or otherwise able to exchange batman-adv frames with an affected host. The attacker then triggers translation-table behavior that causes the vulnerable last_changeset_len value to exceed the signed 16-bit range. When the affected kernel prepares a translation-table response, the wrapped negative length is propagated and causes a mismatch between the amount of memory allocated and the amount of valid data written. The response may include uninitialized kernel memory. The attacker captures the response, extracts leaked bytes, and analyzes them for useful data such as kernel pointers, heap contents, fragments of sensitive data, or information that weakens other exploit mitigations.

How to fix it

Apply a Linux kernel update from the operating system, device, or appliance vendor that includes the batman-adv fix changing the affected length field from signed s16 to unsigned u16. No exact fixed package versions were provided in the input, so use vendor advisories and kernel changelogs to identify the first fixed build for each distribution or product line. Where immediate patching is not possible, disable or unload the batman-adv module if it is not required, remove unused batman-adv mesh interfaces, and restrict batman-adv participation to trusted network segments only. Embedded and appliance vendors should backport the upstream kernel fix into maintained firmware branches.

How to confirm the fix worked

Confirm that the running kernel package or firmware build includes the batman-adv fix for the negative last_changeset_len issue. Validate exposure by checking whether the batman-adv module is loaded and whether batman-adv mesh interfaces are configured. On Linux systems, review module state with commands such as lsmod, modinfo, and ip link, and verify that patched kernel packages are active after reboot. If batman-adv is not required, confirm that the module cannot be loaded automatically and that no batman-adv interfaces remain present. For high-assurance environments, perform packet-level validation on mesh segments to confirm that untrusted nodes cannot exchange batman-adv translation-table traffic with protected systems.

Typical attack path

1. Identify hosts or devices running Linux with the batman-adv kernel module enabled and participating in a mesh network.
2. Gain the ability to send or receive batman-adv traffic on the same mesh or layer-2 network path.
3. Trigger translation-table changes or requests that cause an oversized changeset length condition.
4. Cause the vulnerable host to generate a batman-adv translation-table response.
5. Capture the response and inspect it for uninitialized kernel memory bytes.
6. Use leaked kernel memory contents to disclose sensitive information or support follow-on attacks.

How to detect it

There may be little or no host-level evidence after exploitation because the flaw can disclose memory through normal batman-adv protocol responses without necessarily crashing the system or writing files. Detection should focus on exposure and anomalous mesh-network activity. Review kernel logs and system inventory for batman-adv module loading, batman-adv interface creation, and unexpected mesh participation. Inspect network captures or IDS telemetry from mesh segments for unusual volumes of batman-adv translation-table requests and responses, especially from unknown nodes. If exploitation is suspected, capture batman-adv traffic and inspect translation-table responses for large payloads containing high-entropy or non-protocol-looking data beyond expected structured fields. Also review device admission records, wireless mesh association logs, and network access-control events for unauthorized devices joining the mesh around the suspected timeframe.

• batman_adv
• batman-adv
• bat0
• BATADV_TT_REQUEST
• BATADV_TT_RESPONSE
• translation table
• tt response
• last_changeset_len

What your security team should do

• Prioritize patching Linux systems, embedded devices, routers, wireless mesh nodes, and appliances that use batman-adv.
• Inventory where the batman-adv kernel module is loaded or where batman-adv interfaces such as bat0 are present.
• Disable batman-adv on systems that do not explicitly require mesh networking functionality.
• Restrict mesh network membership and layer-2 adjacency to trusted devices only.
• Monitor batman-adv mesh segments for unusual translation-table request or response activity.
• Track vendor kernel advisories for fixed versions, because exact fixed package versions vary by distribution and product.
• Treat any confirmed kernel memory disclosure as potentially useful for follow-on exploitation, even if no public exploit is currently known.