CVE-2026-31659

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> batman-adv: reject oversized global TT response buffers<br /> <br /> batadv_tt_prepare_tvlv_global_data() builds the allocation length for a<br /> global TT response in 16-bit temporaries. When a remote originator<br /> advertises a large enough global TT, the TT payload length plus the VLAN<br /> header offset can exceed 65535 and wrap before kmalloc().<br /> <br /> The full-table response path still uses the original TT payload length when<br /> it fills tt_change, so the wrapped allocation is too small and<br /> batadv_tt_prepare_tvlv_global_data() writes past the end of the heap object<br /> before the later packet-size check runs.<br /> <br /> Fix this by rejecting TT responses whose TVLV value length cannot fit in<br /> the 16-bit TVLV payload length field.