Cloudanix VulnDB

CVE-2026-80839

None

CVSS

—

EPSS

0.2%

Published

Sep 4, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in Linux wireless mesh networking code can let specially crafted network packets cause crashes or memory errors on affected computers.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Moderate
Impact
Other
Component
OS kernel
Class
Buffer Overflow
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Improper handling of multicast TVLV offsets in batman-adv allows skb_set_transport_header to truncate values, causing skb_network_header_len to return a large u32 and batadv_mcast_forw_packet to accept an oversized tracker leading to out-of-bounds memory access.

Why it matters to the business

Kernel-level memory corruption in wireless mesh networking can cause crashes, denial of service, or potential code execution on affected Linux systems, increasing operational risk for networks relying on batman-adv.

How an attack unfolds

An attacker sends a crafted multicast TVLV with an offset exceeding U16_MAX; the kernel truncates the transport header, computes an invalid network header length, and grants access to memory beyond the skb buffer during forwarding.

How to fix it

Update the Linux kernel to a version containing the skb_set_transport_header_careful helper and the batadv_tvlv_call_handler rejection logic for unrepresentable TVLV offsets.

How to confirm the fix worked

Confirm the presence of skb_set_transport_header_careful in the kernel source or binary and verify that batadv_tvlv_call_handler rejects TVLVs whose end offset exceeds the representable range.

Typical attack path

  1. Craft and transmit a malicious multicast TVLV packet targeting batman-adv
  2. Trigger batadv_tvlv_call_handler to set invalid header offsets without validation
  3. Cause skb_set_transport_header truncation and oversized tracker acceptance
  4. Access out-of-bounds memory in batadv_mcast_forw_packet to corrupt kernel state

How to detect it

Review kernel logs for batman-adv oops or panic messages involving mcast_forw_packet or tvlv_call_handler; inspect network traffic for multicast packets with unusually large TVLV offsets.

What your security team should do

  • Prioritize kernel upgrades on systems using batman-adv mesh networking
  • Monitor upstream Linux kernel releases for backports of the careful header helper
  • Temporarily disable batman-adv multicast forwarding if patching is delayed

The record

In the Linux kernel, the following vulnerability has been resolved: batman-adv: reject unrepresentable multicast TVLV offsets The network and transport header fields in struct sk_buff are 16-bit offsets from skb->head, and U16_MAX is reserved as the unset transport header value. batadv_tvlv_call_handler() sets both fields from a received multicast TVLV without checking whether the TVLV end is representable. If the end offset exceeds the field's range, skb_set_transport_header() truncates it so that the transport header precedes the network header. The negative difference is then returned by skb_network_header_len() as a large u32. batadv_mcast_forw_packet() consequently accepts an oversized multicast tracker and accesses memory beyond the skb data. Add skb_set_transport_header_careful(), an offset-aware counterpart to skb_reset_transport_header_careful(), which validates the final head-relative offset before assigning it. Use the new helper in batadv_tvlv_call_handler() and reject unrepresentable TVLVs before setting the network header.

Affected packages

Ecosystem Package Introduced Fixed