« Volver al listado

CVE-2026-80839

Estado: RecibidaSin puntuar—

In the Linux kernel, the following vulnerability has been resolved:

batman-adv: reject unrepresentable multicast TVLV offsets

The network and transport header fields in struct sk_buff are 16-bit offsets from skb->head, and U16_MAX is reserved as the unset transport header value. batadv_tvlv_call_handler() sets both fields from a received multicast TVLV without checking whether the TVLV end is representable.

If the end offset exceeds the field's range, skb_set_transport_header() truncates it so that the transport header precedes the network header. The negative difference is then returned by skb_network_header_len() as a large u32. batadv_mcast_forw_packet() consequently accepts an oversized multicast tracker and accesses memory beyond the skb data.

Leer descripción completaMostrar menos

Add skb_set_transport_header_careful(), an offset-aware counterpart to skb_reset_transport_header_careful(), which validates the final head-relative offset before assigning it. Use the new helper in batadv_tvlv_call_handler() and reject unrepresentable TVLVs before setting the network header.

CVSS

NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-80839",
  "cveTags": [],
  "metrics": {},
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "07afe1ba288c04280622fa002ed385f1ac0b6fe6",
              "lessThan": "da1f5aa7ec93f2cc17f5cd30efc54f62af433cf2",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "07afe1ba288c04280622fa002ed385f1ac0b6fe6",
              "lessThan": "916ec741e65af072b98e475feaad98c063da1b7c",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "07afe1ba288c04280622fa002ed385f1ac0b6fe6",
              "lessThan": "1b466746fe109127fd983100a228cdd1f1f6ece2",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "07afe1ba288c04280622fa002ed385f1ac0b6fe6",
              "lessThan": "2b46baa591d0a7c16b62f150917187e70d053be6",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "07afe1ba288c04280622fa002ed385f1ac0b6fe6",
              "lessThan": "f12c2de4f542e3220e17e0606f492110064f04cb",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "include/linux/skbuff.h",
            "net/batman-adv/tvlv.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.8"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "6.8",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "6.12.108",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.18.49",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.1.13",
              "versionType": "semver",
              "lessThanOrEqual": "7.1.*"
            },
            {
              "status": "unaffected",
              "version": "7.2.3",
              "versionType": "semver",
              "lessThanOrEqual": "7.2.*"
            },
            {
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "include/linux/skbuff.h",
            "net/batman-adv/tvlv.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-09-04T16:18:12.310",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/1b466746fe109127fd983100a228cdd1f1f6ece2",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/2b46baa591d0a7c16b62f150917187e70d053be6",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/916ec741e65af072b98e475feaad98c063da1b7c",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/da1f5aa7ec93f2cc17f5cd30efc54f62af433cf2",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/f12c2de4f542e3220e17e0606f492110064f04cb",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbatman-adv: reject unrepresentable multicast TVLV offsets\n\nThe network and transport header fields in struct sk_buff are 16-bit\noffsets from skb->head, and U16_MAX is reserved as the unset transport\nheader value. batadv_tvlv_call_handler() sets both fields from a received\nmulticast TVLV without checking whether the TVLV end is representable.\n\nIf the end offset exceeds the field's range, skb_set_transport_header()\ntruncates it so that the transport header precedes the network header.\nThe negative difference is then returned by skb_network_header_len() as\na large u32. batadv_mcast_forw_packet() consequently accepts an oversized\nmulticast tracker and accesses memory beyond the skb data.\n\nAdd skb_set_transport_header_careful(), an offset-aware counterpart to\nskb_reset_transport_header_careful(), which validates the final\nhead-relative offset before assigning it. Use the new helper in\nbatadv_tvlv_call_handler() and reject unrepresentable TVLVs before\nsetting the network header."
    }
  ],
  "lastModified": "2026-09-04T16:18:12.310",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}