PT-2026-51727 · Linux · Linux

Published 2026-06-24 · Updated 2026-06-24 · CVE-2026-52934

Mitre

In the Linux kernel, the following vulnerability has been resolved:

batman-adv: tvlv: reject oversized TVLV packets

batadv tvlv container ogm append() builds a TVLV packet section from the tvlv.container list. The total size of this section is computed by batadv tvlv container list size(), which sums the sizes of all registered containers.

The return type and accumulator in batadv tvlv container list size() were u16. If the accumulated size exceeds U16 MAX, the value wraps around, causing the subsequent allocation in batadv tvlv container ogm append() to be undersized. The memcpy-style copy that follows would then write beyond the end of the allocated buffer, corrupting kernel memory.

Fix this by widening the return type of batadv tvlv container list size() to size t. In batadv tvlv container ogm append(), check the computed length against U16 MAX before proceeding, and bail out as if the allocation had failed when the limit is exceeded.

Related Identifiers

CVE-2026-52934

Affected Products

Linux

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2026-52934 · Security Note
• https://git.kernel.org/stable/c/1595628a2f877d052eda18865ccf539392c47c04 · Note
• https://git.kernel.org/stable/c/6448a49344e87487b61bd88cb850cd694a0f576d · Note
• https://git.kernel.org/stable/c/ede47988ac5687793745b17c1634a496a2299919 · Note
• https://git.kernel.org/stable/c/94a3d72cd9b21116d7c6d5bdc57c11401fc28557 · Note
• https://git.kernel.org/stable/c/c02aa6c0c9d1bea9bb75dea362b75ad225137bae · Note
• https://git.kernel.org/stable/c/13493b00dd1e05a705981e052158652ea23eb482 · Note
• https://git.kernel.org/stable/c/f50487e3566358b2b982b7801945e858c78ad9ab · Note
• https://git.kernel.org/stable/c/94db72e9dac202e017ee3db22c59d17e4f3bf171 · Note