CVE-2026-46198: batman-adv: fix integer overflow on buff_pos

Synopsis

An integer overflow vulnerability in the Linux kernel's batman-adv mesh networking driver (batadv_iv_ogm_send_to_if) allows an attacker on the same network segment to trigger an out-of-bounds read. The flaw arises because a size check uses an int type while the buff_pos variable uses a signed 16-bit (s16) type, enabling the buffer position to wrap and read memory outside the intended region. Successful exploitation gives the attacker full read, write, and crash capability against the affected host. Patched-image rebuilds at fix versions 6.6.140, 6.12.90, and 6.18.32 are available on HarborGuard for environments running an affected kernel version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityDetail

  The attacker must be on the same adjacent network segment (LAN, VLAN, or VPN) as the target; remote internet-based access is not sufficient.

• AuthenticationNot required

  No account or credentials are needed to send crafted batman-adv OGM packets toward the target.

• Victim interactionNot required

  The vulnerability is triggered by network packets alone; no user on the target system needs to take any action.

• Attack complexityDetail

  Exploitation is reliable and requires no special environmental conditions, race conditions, or memory layout knowledge.

Blast Radius

• An attacker reads kernel memory outside the intended buffer, potentially exposing sensitive data such as credentials, keys, or other process memory contents.
• An attacker gains write-equivalent impact (CVSS I:H), enabling modification of kernel data structures or persisted state.
• An attacker can crash the affected kernel, taking down all workloads running on that host.