CVE-2026-64089

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> batman-adv: tt: fix negative last_changeset_len<br /> <br /> batadv_piv_tt::last_changeset_len len was declared as s16, but the field is<br /> never intended to hold a negative value. When a value greater than 32767 is<br /> assigned, it wraps to a negative signed integer.<br /> <br /> In batadv_send_my_tt_response(), last_changeset_len is temporarily widened<br /> to s32. The incorrectly negative s16 value propagates into the s32, causing<br /> batadv_tt_prepare_tvlv_local_data() to allocate a full sized buffer but<br /> populates only a small portion of it with the collected changeset. All<br /> remaining bits are kept uninitialized.<br /> <br /> Using an u16 avoids this type confusion and ensures that no (negative) sign<br /> extension is performed in batadv_send_my_tt_response().