PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46198 Linux CVE debrief

An integer overflow vulnerability exists in the Linux kernel's batman-adv (Better Approach To Mobile Ad-hoc Networking) subsystem. The flaw occurs in `batadv_iv_ogm_send_to_if` where `buff_pos` is declared as `s16` (signed 16-bit), but size validation in `batadv_iv_ogm_aggr_packet` uses `int` type. This type mismatch can cause integer overflow, leading to out-of-bounds read conditions when processing aggregated OGM (Originator Message) packets. The vulnerability affects the mesh networking protocol implementation used for decentralized wireless networks.

Vendor
Linux
Product
Unknown
CVSS
HIGH 8.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-28
Original CVE updated
2026-06-10
Advisory published
2026-05-28
Advisory updated
2026-06-10

Who should care

Organizations deploying Linux-based mesh networks using batman-adv, wireless ISPs, community network operators, and enterprises using B.A.T.M.A.N. protocol for decentralized network infrastructure.

Technical summary

The batman-adv kernel module implements the B.A.T.M.A.N. mesh routing protocol. The vulnerability stems from inconsistent integer typing: `buff_pos` uses `s16` while aggregation size checks use `int`. When processing aggregated OGM packets, this discrepancy can cause signed 16-bit overflow, resulting in negative buffer positions that bypass bounds checks and enable out-of-bounds memory access. The fix involves aligning type usage or adding proper overflow validation in the aggregation packet handling path.

Defensive priority

medium

Recommended defensive actions

  • Review kernel version and confirm batman-adv module usage in network infrastructure
  • Apply kernel updates from distribution security channels when available
  • Monitor stable kernel git commits for backported fixes to currently deployed versions
  • Consider disabling batman-adv kernel module if mesh networking functionality is not required
  • Validate network segmentation to limit exposure of batman-adv-enabled systems

Evidence notes

The vulnerability description indicates a type mismatch between `s16 buff_pos` and `int` size checks in batman-adv's OGM aggregation handling. Multiple stable kernel branch commits are referenced, suggesting coordinated fixes across supported kernel versions. The NVD entry status is 'Awaiting Analysis' as of the source publication date.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-46198 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-46198

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-46198 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-46198

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/0799e5943611006b346b8813c7daf7dd5aa26bfd

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/974542d1efc48b7e9fe16184e647615cba39969b

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/b252797bfced986d6d92ec2f4cfcca842ce8aa78

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/bf872db54f91ffe70104b98c20068b2d5910e018

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/f61499359fa529f0d45a53bf7c573a49eb6322e6

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.