---
id: CVE-2026-72226
title: 'batman-adv: tt: prevent TVLV OOB check overflow'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  batman-adv: tt: prevent TVLV OOB check overflow

  A TT unicast TVLV contains the number of VLANs stored in it. This number is
  an u16 and gets multiplied by the size of t…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 7ea7b4a142758deaf46c1af0ca9ceca6dd55138b <
    0de12a4c4847f571d82a9cd96bc633eded41d7c6
  - >-
    Linux >= 7ea7b4a142758deaf46c1af0ca9ceca6dd55138b <
    d6ff4764ff784ede25f5c83a6f5883a74c93a5ea
  - >-
    Linux >= 7ea7b4a142758deaf46c1af0ca9ceca6dd55138b <
    1898273c5dc8148267ef9f97cd2517a2822350e7
  - >-
    Linux >= 7ea7b4a142758deaf46c1af0ca9ceca6dd55138b <
    604bd5042fbcd1ab9f7cd98fd847ec017aeede8a
  - >-
    Linux >= 7ea7b4a142758deaf46c1af0ca9ceca6dd55138b <
    7319c0794f91be2734aac695794e7203606b49f8
  - >-
    Linux >= 7ea7b4a142758deaf46c1af0ca9ceca6dd55138b <
    3256c05d5a9db34346eaf20f52dddde984852d77
  - >-
    Linux >= 7ea7b4a142758deaf46c1af0ca9ceca6dd55138b <
    6222b443686525cb5a9b6a9cecf23b2e2ab23e2a
  - >-
    Linux >= 7ea7b4a142758deaf46c1af0ca9ceca6dd55138b <
    7a581d9aaba8c82bd6177fa36b2588eea77f6e2b
  - Linux 3.13
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-10-16T18:44:17.010963Z'
published: '2026-08-15'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T18:45:02.826Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-72226'
references:
  - url: 'https://git.kernel.org/stable/c/0de12a4c4847f571d82a9cd96bc633eded41d7c6'
  - url: 'https://git.kernel.org/stable/c/d6ff4764ff784ede25f5c83a6f5883a74c93a5ea'
  - url: 'https://git.kernel.org/stable/c/1898273c5dc8148267ef9f97cd2517a2822350e7'
  - url: 'https://git.kernel.org/stable/c/604bd5042fbcd1ab9f7cd98fd847ec017aeede8a'
  - url: 'https://git.kernel.org/stable/c/7319c0794f91be2734aac695794e7203606b49f8'
  - url: 'https://git.kernel.org/stable/c/3256c05d5a9db34346eaf20f52dddde984852d77'
  - url: 'https://git.kernel.org/stable/c/6222b443686525cb5a9b6a9cecf23b2e2ab23e2a'
  - url: 'https://git.kernel.org/stable/c/7a581d9aaba8c82bd6177fa36b2588eea77f6e2b'
tags:
  - cve.org
epss: 0.00755
epssPercentile: 0.54211
ingestedAt: '2026-10-16T19:46:24.421Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

batman-adv: tt: prevent TVLV OOB check overflow

A TT unicast TVLV contains the number of VLANs stored in it. This number is
an u16 and gets multiplied by the size of the struct
batadv_tvlv_tt_vlan_data (8 bytes). The size can therefore overflow the u16
used to store the tt_vlan_len. All additional safety checks to prevent
out-of-bounds access of the TVLV buffer are invalid due to this overflow.

Using size_t prevents this overflow and ensures that the safety checks
compare against the actual buffer requirements.

## Affected

- `Linux >= 7ea7b4a142758deaf46c1af0ca9ceca6dd55138b < 0de12a4c4847f571d82a9cd96bc633eded41d7c6`
- `Linux >= 7ea7b4a142758deaf46c1af0ca9ceca6dd55138b < d6ff4764ff784ede25f5c83a6f5883a74c93a5ea`
- `Linux >= 7ea7b4a142758deaf46c1af0ca9ceca6dd55138b < 1898273c5dc8148267ef9f97cd2517a2822350e7`
- `Linux >= 7ea7b4a142758deaf46c1af0ca9ceca6dd55138b < 604bd5042fbcd1ab9f7cd98fd847ec017aeede8a`
- `Linux >= 7ea7b4a142758deaf46c1af0ca9ceca6dd55138b < 7319c0794f91be2734aac695794e7203606b49f8`
- `Linux >= 7ea7b4a142758deaf46c1af0ca9ceca6dd55138b < 3256c05d5a9db34346eaf20f52dddde984852d77`
- `Linux >= 7ea7b4a142758deaf46c1af0ca9ceca6dd55138b < 6222b443686525cb5a9b6a9cecf23b2e2ab23e2a`
- `Linux >= 7ea7b4a142758deaf46c1af0ca9ceca6dd55138b < 7a581d9aaba8c82bd6177fa36b2588eea77f6e2b`
- `Linux 3.13`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.