CVE-2026-52934: Linux Batman-adv TVLV Buffer Overflow Vulnerability

Technical summary

The vulnerability exists in batadv_tvlv_container_list_size() and batadv_tvlv_container_ogm_append() functions within the batman-adv kernel module. The function batadv_tvlv_container_list_size() accumulates TVLV container sizes in a u16 variable, which has a maximum value of 65,535 bytes. If the sum of registered container sizes exceeds U16_MAX, integer overflow occurs, truncating the result. The caller, batadv_tvlv_container_ogm_append(), uses this truncated size for memory allocation. Subsequent memcpy operations then write the full packet payload into the undersized buffer, causing a classic heap buffer overflow. The patch widens the accumulator to size_t and adds validation to reject packets exceeding U16_MAX before allocation is attempted.

Business impact

Exploitation of this vulnerability allows local attackers to corrupt kernel memory, potentially escalating privileges, executing arbitrary code with kernel privileges, or triggering a denial of service. Organizations relying on batman-adv for mesh networking (common in edge computing, IoT deployments, and some enterprise wireless scenarios) face elevated risk. A successful exploit could compromise the confidentiality, integrity, and availability of systems running vulnerable kernels. Affected infrastructure may require immediate remediation to prevent lateral movement and privilege escalation attacks.

Affected systems

All Linux kernel versions containing the batman-adv subsystem are affected. batman-adv is a kernel module used for mesh networking and is often compiled into distributions targeting IoT, embedded systems, and specialized networking appliances. Standard desktop and server distributions typically include the module, though it may not be actively used unless mesh networking is configured. The vulnerability does not require batman-adv interfaces to be administratively enabled; the vulnerable code path is reachable during module initialization and TVLV container registration.

Exploitability

The vulnerability requires local network access (AV:A per CVSS vector) to craft or inject malicious TVLV packets. No authentication or user interaction is required. An attacker positioned on the same network segment—or with access to a system where batman-adv is loaded—can register oversized TVLV containers or send specially crafted packets to trigger the overflow. While not remotely exploitable over the internet, the barrier to exploitation for a local attacker is low, making this a significant risk in multi-tenant or open-network environments.

Remediation

Apply kernel patches that widen batadv_tvlv_container_list_size() to return size_t and add U16_MAX validation in batadv_tvlv_container_ogm_append(). Patches should be available from your Linux distribution's security repository. For systems where batman-adv is unnecessary, the module can be blacklisted to eliminate the attack surface entirely. Verify patched kernel versions with your vendor and test in a staging environment before production deployment.

Patch guidance

Consult your Linux distribution's security advisory and package repository for the patched kernel version specific to your release. Major distributions (Ubuntu, Red Hat, Debian, SUSE) will provide kernel updates addressing CVE-2026-52934. The fix involves backporting patches that: (1) change the return type and internal accumulator of batadv_tvlv_container_list_size() from u16 to size_t, and (2) add a bounds check in batadv_tvlv_container_ogm_append() to reject any TVLV section exceeding U16_MAX bytes. Verify against the vendor advisory for exact patch identifiers and backport status for your kernel version.

Detection guidance

Monitor kernel logs for memory corruption messages (segmentation faults, kernel panics, or sanitizer warnings) originating from batman-adv code paths. If CONFIG_KASAN or CONFIG_KMSAN is enabled, out-of-bounds writes will be detected and logged. Network-based detection is difficult without deep packet inspection of TVLV traffic; focus on system-level anomalies like unexpected kernel crashes, memory errors in dmesg, or process terminations. Organizations using integrity monitoring tools should watch for unexpected modifications to kernel memory structures. Behavioral indicators include repeated kernel oops events or system instability following network traffic spikes on batman-adv interfaces.

Why prioritize this

This vulnerability rates HIGH (CVSS 8.8) due to the combination of kernel-level code execution potential, high impact (confidentiality, integrity, and availability all compromised), and low complexity of exploitation. Although it requires local network access, the low barrier to trigger it in vulnerable configurations and the severity of the consequences (privilege escalation, persistent compromise) justify treating it as a priority patch. Organizations running batman-adv or mesh-networking solutions should prioritize remediation within their normal patch cycles.

Risk score, explained

The CVSS 3.1 score of 8.8 reflects: Attack Vector (Adjacent Network) recognizing that the attacker must be on the local network but can act without special position; Attack Complexity (Low) because no special conditions must be met beyond network presence; Privileges Required (None) and User Interaction (None) confirming the vulnerability is triggered automatically by crafted packets; Scope (Unchanged) because the impact is contained to the affected system; and Confidentiality, Integrity, and Availability all marked as High because kernel memory corruption can lead to information disclosure, system modification, and service disruption. The combination of direct kernel memory corruption and privilege escalation potential justifies the HIGH severity rating.

Frequently asked questions