CVE-2026-52934

Description

In the Linux kernel, the following vulnerability has been resolved: batman-adv: tvlv: reject oversized TVLV packets batadv_tvlv_container_ogm_append() builds a TVLV packet section from the tvlv.container_list. The total size of this section is computed by batadv_tvlv_container_list_size(), which sums the sizes of all registered containers. The return type and accumulator in batadv_tvlv_container_list_size() were u16. If the accumulated size exceeds U16_MAX, the value wraps around, causing the subsequent allocation in batadv_tvlv_container_ogm_append() to be undersized. The memcpy-style copy that follows would then write beyond the end of the allocated buffer, corrupting kernel memory. Fix this by widening the return type of batadv_tvlv_container_list_size() to size_t. In batadv_tvlv_container_ogm_append(), check the computed length against U16_MAX before proceeding, and bail out as if the allocation had failed when the limit is exceeded.

CVSS v3.1 Score

8.8

HIGH

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS — Exploit Prediction

0.0025

Probability of exploitation

0.16%

Percentile rank

EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.

References

Other References

https://git.kernel.org/stable/c/13493b00dd1e05a705981e052158652ea23eb482 https://git.kernel.org/stable/c/1595628a2f877d052eda18865ccf539392c47c04 https://git.kernel.org/stable/c/6448a49344e87487b61bd88cb850cd694a0f576d https://git.kernel.org/stable/c/94a3d72cd9b21116d7c6d5bdc57c11401fc28557 https://git.kernel.org/stable/c/94db72e9dac202e017ee3db22c59d17e4f3bf171 https://git.kernel.org/stable/c/c02aa6c0c9d1bea9bb75dea362b75ad225137bae https://git.kernel.org/stable/c/ede47988ac5687793745b17c1634a496a2299919 https://git.kernel.org/stable/c/f50487e3566358b2b982b7801945e858c78ad9ab

Frequently Asked Questions

What is CVE-2026-52934? +

In the Linux kernel, the following vulnerability has been resolved: batman-adv: tvlv: reject oversized TVLV packets batadv_tvlv_container_ogm_append() builds a TVLV packet section from the tvlv.container_list. The total size of this section is computed by batadv_tvlv_container_list_size(), which sums the sizes of all registered containers. The return type and accumulator in batadv_tvlv_container_list_size() were u16. If the accumulated size exceeds U16_MAX, the value wraps around, causing the subsequent allocation in batadv_tvlv_container_ogm_append() to be undersized. The memcpy-style copy that follows would then write beyond the end of the allocated buffer, corrupting kernel memory. Fix this by widening the return type of batadv_tvlv_container_list_size() to size_t. In batadv_tvlv_container_ogm_append(), check the computed length against U16_MAX before proceeding, and bail out as if the allocation had failed when the limit is exceeded. It has a CVSS v3.1 base score of 8.8 (HIGH).

How severe is CVE-2026-52934? +

CVE-2026-52934 has a CVSS v3.1 score of 8.8 out of 10, rated HIGH. This is a high-severity vulnerability that should be prioritized for patching. The EPSS score is 0.0025, placing it in the 0th percentile for exploitation probability.

How do I check if I'm vulnerable to CVE-2026-52934? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.