CVE-2026-64088

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> batman-adv: tt: fix negative tt_buff_len<br /> <br /> batadv_orig_node::tt_buff_len was declared as s16, but the field is never<br /> intended to hold a negative value. When a value greater than 32767 is<br /> assigned, it wraps to a negative signed integer.<br /> <br /> In batadv_send_other_tt_response(), tt_buff_len is temporarily widened to<br /> s32. The incorrectly negative s16 value propagates into the s32, causing<br /> batadv_tt_prepare_tvlv_global_data() to allocate a full sized buffer but<br /> populates only a small portion of it with the collected changeset. All<br /> remaining bits are kept uninitialized.<br /> <br /> Using an u16 avoids this type confusion and ensures that no (negative) sign<br /> extension is performed in batadv_send_other_tt_response().