CVE-2026-72226

A flaw was found in the Linux kernel's batman-adv (Better Approach To Mobile Ad-hoc Networking - Advanced) module. An integer overflow can occur when calculating the length of a Translation Table Type-Length-Value (TVLV) unicast message. This overflow can lead to invalid safety checks, allowing an out-of-bounds write to the TVLV buffer. This vulnerability could result in memory corruption.

Moderate severity is assigned to this flaw because triggering it requires processing specially structured mesh networking translation table packets, limiting the primary impact to a localized denial of service or potential memory corruption. On Red Hat Enterprise Linux, the B.A.T.M.A.N. advanced module is not enabled in default kernel builds, preventing standard deployments from being exposed. Consequently, only non-standard or custom environments actively utilizing this ad-hoc networking protocol are at risk.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.