CVE-2026-80839

Full vulnerability record from the local CVENow database.

Description

In the Linux kernel, the following vulnerability has been resolved: batman-adv: reject unrepresentable multicast TVLV offsets The network and transport header fields in struct sk_buff are 16-bit offsets from skb->head, and U16_MAX is reserved as the unset transport header value. batadv_tvlv_call_handler() sets both fields from a received multicast TVLV without checking whether the TVLV end is representable. If the end offset exceeds the field's range, skb_set_transport_header() truncates it so that the transport header precedes the network header. The negative difference is then returned by skb_network_header_len() as a large u32. batadv_mcast_forw_packet() consequently accepts an oversized multicast tracker and accesses memory beyond the skb data. Add skb_set_transport_header_careful(), an offset-aware counterpart to skb_reset_transport_header_careful(), which validates the final head-relative offset before assigning it. Use the new helper in batadv_tvlv_call_handler() and reject unrepresentable TVLVs before setting the network header.

Severity

Not scored

CVSS score

Not available

Vulnerability status

Received

Source identifier

416baaa9-dc9f-4396-8d5f-8c081fb06d67

Published

2026-09-04 16:18:12.310000

Last modified

2026-10-19 09:17:19.223000

View original CVE JSON

{
  "id": "CVE-2026-80839",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "published": "2026-09-04T16:18:12.310",
  "lastModified": "2026-10-19T09:17:19.223",
  "vulnStatus": "Received",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbatman-adv: reject unrepresentable multicast TVLV offsets\n\nThe network and transport header fields in struct sk_buff are 16-bit\noffsets from skb->head, and U16_MAX is reserved as the unset transport\nheader value. batadv_tvlv_call_handler() sets both fields from a received\nmulticast TVLV without checking whether the TVLV end is representable.\n\nIf the end offset exceeds the field's range, skb_set_transport_header()\ntruncates it so that the transport header precedes the network header.\nThe negative difference is then returned by skb_network_header_len() as\na large u32. batadv_mcast_forw_packet() consequently accepts an oversized\nmulticast tracker and accesses memory beyond the skb data.\n\nAdd skb_set_transport_header_careful(), an offset-aware counterpart to\nskb_reset_transport_header_careful(), which validates the final\nhead-relative offset before assigning it. Use the new helper in\nbatadv_tvlv_call_handler() and reject unrepresentable TVLVs before\nsetting the network header."
    }
  ],
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "unaffected",
          "programFiles": [
            "include/linux/skbuff.h",
            "net/batman-adv/tvlv.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "07afe1ba288c04280622fa002ed385f1ac0b6fe6",
              "lessThan": "da1f5aa7ec93f2cc17f5cd30efc54f62af433cf2",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "07afe1ba288c04280622fa002ed385f1ac0b6fe6",
              "lessThan": "916ec741e65af072b98e475feaad98c063da1b7c",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "07afe1ba288c04280622fa002ed385f1ac0b6fe6",
              "lessThan": "1b466746fe109127fd983100a228cdd1f1f6ece2",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "07afe1ba288c04280622fa002ed385f1ac0b6fe6",
              "lessThan": "2b46baa591d0a7c16b62f150917187e70d053be6",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "07afe1ba288c04280622fa002ed385f1ac0b6fe6",
              "lessThan": "f12c2de4f542e3220e17e0606f492110064f04cb",
              "versionType": "git",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "affected",
          "programFiles": [
            "include/linux/skbuff.h",
            "net/batman-adv/tvlv.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "6.8",
              "status": "affected"
            },
            {
              "version": "0",
              "lessThan": "6.8",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.12.108",
              "lessThanOrEqual": "6.12.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.18.49",
              "lessThanOrEqual": "6.18.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "7.1.13",
              "lessThanOrEqual": "7.1.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "7.2.3",
              "lessThanOrEqual": "7.2.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "7.3",
              "lessThanOrEqual": "*",
              "versionType": "original_commit_for_fix",
              "status": "unaffected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {},
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/1b466746fe109127fd983100a228cdd1f1f6ece2",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/2b46baa591d0a7c16b62f150917187e70d053be6",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/916ec741e65af072b98e475feaad98c063da1b7c",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/da1f5aa7ec93f2cc17f5cd30efc54f62af433cf2",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/f12c2de4f542e3220e17e0606f492110064f04cb",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ]
}