CVE-2026-31659

CVE-2026-31659 describes a critical vulnerability in the Linux kernel's batman-adv module. The function batadv_tt_prepare_tvlv_global_data() allocates memory for a global translation table (TT) response using 16-bit temporary variables. When a remote originator advertises a sufficiently large global TT, the combined TT payload length and VLAN header offset can overflow 16 bits, wrapping to a small value before kmalloc(). This results in a heap buffer that is too small for the actual data, leading to a heap out-of-bounds write.

An attacker on the same batman-adv mesh network can exploit this by sending a crafted TT response with a large payload length. No authentication is required if the network accepts TT advertisements from any node. The overflow occurs before a later packet-size check, so the attacker can write controlled data past the end of the allocated heap object.

Successful exploitation allows arbitrary code execution in kernel context, potentially leading to full system compromise. The CVSS v3 score of 9.8 reflects the critical severity and remote attack vector.

The fix, introduced in the kernel stable tree, rejects TT responses whose TVLV value length cannot fit in the 16-bit TVLV payload length field. Affected users should apply the stable kernel update containing commits [1], [2], [3], or [4] as appropriate for their kernel version. No workaround is available.