CVE-2026-64089 (CVSS 9.8)

Description

In the Linux kernel, the following vulnerability has been resolved: batman-adv: tt: fix negative last_changeset_len batadv_piv_tt::last_changeset_len len was declared as s16, but the field is never intended to hold a negative value. When a value greater than 32767 is assigned, it wraps to a negative signed integer. In batadv_send_my_tt_response(), last_changeset_len is temporarily widened to s32. The incorrectly negative s16 value propagates into the s32, causing batadv_tt_prepare_tvlv_local_data() to allocate a full sized buffer but populates only a small portion of it with the collected changeset. All remaining bits are kept uninitialized. Using an u16 avoids this type confusion and ensures that no (negative) sign extension is performed in batadv_send_my_tt_response().

Is your site exposed to CVE-2026-64089?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

9.8

CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS — Exploit Prediction

0.0056

Probability of exploitation

0.43%

Percentile rank

EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.

References

Other References

https://git.kernel.org/stable/c/179eb62506a02d00370bd6478898cb632e10986c https://git.kernel.org/stable/c/22d59c72f4a47ffec121d0610f70d0d70c3c11c8 https://git.kernel.org/stable/c/55dc41fe8821e9a849e147255ad572bc933a9d15 https://git.kernel.org/stable/c/6314089acf0ddf64376fdc0b1420695504c73f52 https://git.kernel.org/stable/c/c424e8519ac78eac5d9f4eecf06208a0d619ec14 https://git.kernel.org/stable/c/d29abf70c665730e249d2ec8e1402095ae26bcee https://git.kernel.org/stable/c/eb235472b52ef36981c5aad330485eaf2382c53b https://git.kernel.org/stable/c/fc92cdfcb295cefa4344d71a527d61b638b7bfc4

Frequently Asked Questions

What is CVE-2026-64089? +

In the Linux kernel, the following vulnerability has been resolved: batman-adv: tt: fix negative last_changeset_len batadv_piv_tt::last_changeset_len len was declared as s16, but the field is never intended to hold a negative value. When a value greater than 32767 is assigned, it wraps to a negative signed integer. In batadv_send_my_tt_response(), last_changeset_len is temporarily widened to s32. The incorrectly negative s16 value propagates into the s32, causing batadv_tt_prepare_tvlv_local_data() to allocate a full sized buffer but populates only a small portion of it with the collected changeset. All remaining bits are kept uninitialized. Using an u16 avoids this type confusion and ensures that no (negative) sign extension is performed in batadv_send_my_tt_response(). It has a CVSS v3.1 base score of 9.8 (CRITICAL).

How severe is CVE-2026-64089? +

CVE-2026-64089 has a CVSS v3.1 score of 9.8 out of 10, rated CRITICAL. This is a critical vulnerability that should be patched immediately. The EPSS score is 0.0056, placing it in the 0th percentile for exploitation probability.

How do I check if I'm vulnerable to CVE-2026-64089? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

CVE-2026-64089