CVE-2026-31659

In the Linux kernel, the following vulnerability has been resolved: batman-adv: reject oversized global TT response buffers batadv_tt_prepare_tvlv_global_data() builds the allocation length for a global TT response in 16-bit temporaries. When a remote originator advertises a large enough global TT, the TT payload length plus the VLAN header offset can exceed 65535 and wrap before kmalloc(). The full-table response path still uses the original TT payload length when it fills tt_change, so the wrapped allocation is too small and batadv_tt_prepare_tvlv_global_data() writes past the end of the heap object before the later packet-size check runs. Fix this by rejecting TT responses whose TVLV value length cannot fit in the 16-bit TVLV payload length field.

• linux linux kernel (>= 3.13.1 < 5.10.253) • linux linux kernel (>= 5.11 < 5.15.203) • linux linux kernel (>= 5.16 < 6.1.169) • linux linux kernel (>= 6.2 < 6.6.135) • linux linux kernel (>= 6.7 < 6.12.82) • linux linux kernel (>= 6.13 < 6.18.23) • linux linux kernel (>= 6.19 < 6.19.13) • linux linux kernel 3.13 • linux linux kernel 7.0