CVE-2026-46198 batman-adv: fix integer overflow on buff_pos

🗓️ 28 May 2026 09:40:14Reported by LinuxType

Fixed integer overflow in batman-adv buff_pos in batadv_iv_ogm_aggr_packet causing out-of-bounds read.

Reporter	Title	Published	Views	Family All 38
ATTACKERKB	CVE-2026-46198	28 May 202609:40	–	attackerkb
CNNVD	Linux kernel 安全漏洞	28 May 202600:00	–	cnnvd
CVE	CVE-2026-46198	28 May 202609:40	–	cve
Debian CVE	CVE-2026-46198	28 May 202609:40	–	debiancve
EUVD	EUVD-2026-32825	28 May 202609:40	–	euvd
Microsoft CVE	batman-adv: fix integer overflow on buff_pos	29 May 202608:02	–	mscve
NVD	CVE-2026-46198	28 May 202610:16	–	nvd
OSV	BELL-CVE-2026-46198	2 Jun 202606:11	–	osv
OSV	DEBIAN-CVE-2026-46198	28 May 202610:16	–	osv
OSV	ECHO-76F4-7CF3-CF0C	28 May 202623:19	–	osv

[
  {
    "product": "Linux",
    "vendor": "Linux",
    "defaultStatus": "unaffected",
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "programFiles": [
      "net/batman-adv/bat_iv_ogm.c"
    ],
    "versions": [
      {
        "version": "c6c8fea29769d998d94fcec9b9f14d4b52b349d3",
        "lessThan": "867cd090760e8f5cd206f387b47ff9c56fac04e9",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "c6c8fea29769d998d94fcec9b9f14d4b52b349d3",
        "lessThan": "10bb1f366d884d506c38a947b43026a75d1afe9a",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "c6c8fea29769d998d94fcec9b9f14d4b52b349d3",
        "lessThan": "96c9c0ed9a9579a9085765aceaa4556a6666eb82",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "c6c8fea29769d998d94fcec9b9f14d4b52b349d3",
        "lessThan": "f61499359fa529f0d45a53bf7c573a49eb6322e6",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "c6c8fea29769d998d94fcec9b9f14d4b52b349d3",
        "lessThan": "974542d1efc48b7e9fe16184e647615cba39969b",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "c6c8fea29769d998d94fcec9b9f14d4b52b349d3",
        "lessThan": "bf872db54f91ffe70104b98c20068b2d5910e018",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "c6c8fea29769d998d94fcec9b9f14d4b52b349d3",
        "lessThan": "b252797bfced986d6d92ec2f4cfcca842ce8aa78",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "c6c8fea29769d998d94fcec9b9f14d4b52b349d3",
        "lessThan": "0799e5943611006b346b8813c7daf7dd5aa26bfd",
        "status": "affected",
        "versionType": "git"
      }
    ]
  },
  {
    "product": "Linux",
    "vendor": "Linux",
    "defaultStatus": "affected",
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "programFiles": [
      "net/batman-adv/bat_iv_ogm.c"
    ],
    "versions": [
      {
        "version": "2.6.38",
        "status": "affected"
      },
      {
        "version": "0",
        "lessThan": "2.6.38",
        "status": "unaffected",
        "versionType": "semver"
      },
      {
        "version": "5.10.258",
        "lessThanOrEqual": "5.10.*",
        "status": "unaffected",
        "versionType": "semver"
      },
      {
        "version": "5.15.209",
        "lessThanOrEqual": "5.15.*",
        "status": "unaffected",
        "versionType": "semver"
      },
      {
        "version": "6.1.175",
        "lessThanOrEqual": "6.1.*",
        "status": "unaffected",
        "versionType": "semver"
      },
      {
        "version": "6.6.140",
        "lessThanOrEqual": "6.6.*",
        "status": "unaffected",
        "versionType": "semver"
      },
      {
        "version": "6.12.90",
        "lessThanOrEqual": "6.12.*",
        "status": "unaffected",
        "versionType": "semver"
      },
      {
        "version": "6.18.32",
        "lessThanOrEqual": "6.18.*",
        "status": "unaffected",
        "versionType": "semver"
      },
      {
        "version": "7.0.9",
        "lessThanOrEqual": "7.0.*",
        "status": "unaffected",
        "versionType": "semver"
      },
      {
        "version": "7.1",
        "lessThanOrEqual": "*",
        "status": "unaffected",
        "versionType": "original_commit_for_fix"
      }
    ]
  }
]

Source	Link
git	www.git.kernel.org/stable/c/96c9c0ed9a9579a9085765aceaa4556a6666eb82
git	www.git.kernel.org/stable/c/0799e5943611006b346b8813c7daf7dd5aa26bfd
git	www.git.kernel.org/stable/c/bf872db54f91ffe70104b98c20068b2d5910e018
git	www.git.kernel.org/stable/c/b252797bfced986d6d92ec2f4cfcca842ce8aa78
git	www.git.kernel.org/stable/c/f61499359fa529f0d45a53bf7c573a49eb6322e6
git	www.git.kernel.org/stable/c/867cd090760e8f5cd206f387b47ff9c56fac04e9
git	www.git.kernel.org/stable/c/10bb1f366d884d506c38a947b43026a75d1afe9a
git	www.git.kernel.org/stable/c/974542d1efc48b7e9fe16184e647615cba39969b

14 Jun 2026 18:02Current

CVSS 3.18.8

EPSS0.00285