CVE-2026-46198
published 2026-05-28CVE-2026-46198: In the Linux kernel, the following vulnerability has been resolved: batman-adv: fix integer overflow on buff_pos Fixing an integer overflow present in…
PriorityP347high8.8CVSS 3.1
AVAACLPRNUINSUCHIHAH
EPSS
0.28%
20.2th percentile
In the Linux kernel, the following vulnerability has been resolved:
batman-adv: fix integer overflow on buff_pos
Fixing an integer overflow present in batadv_iv_ogm_send_to_if. The size
check is done using the int type in batadv_iv_ogm_aggr_packet whereas the
buff_pos variable uses the s16 type. This could lead to an out-of-bound
read.
Affected
19 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| linux | linux | — | — |
| linux | linux | >= c6c8fea29769d998d94fcec9b9f14d4b52b349d3 < 867cd090760e8f5cd206f387b47ff9c56fac04e9 | 867cd090760e8f5cd206f387b47ff9c56fac04e9 |
| linux | linux | >= c6c8fea29769d998d94fcec9b9f14d4b52b349d3 < 10bb1f366d884d506c38a947b43026a75d1afe9a | 10bb1f366d884d506c38a947b43026a75d1afe9a |
| linux | linux | >= c6c8fea29769d998d94fcec9b9f14d4b52b349d3 < 96c9c0ed9a9579a9085765aceaa4556a6666eb82 | 96c9c0ed9a9579a9085765aceaa4556a6666eb82 |
| linux | linux | >= c6c8fea29769d998d94fcec9b9f14d4b52b349d3 < f61499359fa529f0d45a53bf7c573a49eb6322e6 | f61499359fa529f0d45a53bf7c573a49eb6322e6 |
| linux | linux | >= c6c8fea29769d998d94fcec9b9f14d4b52b349d3 < 974542d1efc48b7e9fe16184e647615cba39969b | 974542d1efc48b7e9fe16184e647615cba39969b |
| linux | linux | >= c6c8fea29769d998d94fcec9b9f14d4b52b349d3 < bf872db54f91ffe70104b98c20068b2d5910e018 | bf872db54f91ffe70104b98c20068b2d5910e018 |
| linux | linux | >= c6c8fea29769d998d94fcec9b9f14d4b52b349d3 < b252797bfced986d6d92ec2f4cfcca842ce8aa78 | b252797bfced986d6d92ec2f4cfcca842ce8aa78 |
| linux | linux | >= c6c8fea29769d998d94fcec9b9f14d4b52b349d3 < 0799e5943611006b346b8813c7daf7dd5aa26bfd | 0799e5943611006b346b8813c7daf7dd5aa26bfd |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 2.6.38 < 5.10.258 | 5.10.258 |
| linux | linux_kernel | >= 5.11 < 5.15.209 | 5.15.209 |
| linux | linux_kernel | >= 5.16 < 6.1.175 | 6.1.175 |
| linux | linux_kernel | >= 6.13 < 6.18.32 | 6.18.32 |
| linux | linux_kernel | >= 6.19 < 7.0.9 | 7.0.9 |
| linux | linux_kernel | >= 6.2 < 6.6.140 | 6.6.140 |
| linux | linux_kernel | >= 6.7 < 6.12.90 | 6.12.90 |
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vendor_redhat7.0MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Linux Kernel up to 7.1-rc3 batman-adv batadv_iv_ogm_send_to_if integer overflow (EUVD-2026-32825)
vuldb·2026-06-11·CVSS 8.8
CVE-2026-46198 [HIGH] Linux Kernel up to 7.1-rc3 batman-adv batadv_iv_ogm_send_to_if integer overflow (EUVD-2026-32825)
A vulnerability, which was classified as critical, has been found in Linux Kernel up to 6.6.139/6.12.89/6.18.31/7.0.8/7.1-rc3. The impacted element is the function batadv_iv_ogm_send_to_if of the component batman-adv. This manipulation causes integer overflow.
This vulnerability appears as CVE-2026-46198. The attacker needs to be present on the local network. There is no available exploit.
It is advisable to upgrade the affected component.
GHSA
GHSA-633g-3jmf-hx7h: In the Linux kernel, the following vulnerability has been resolved:
batman-adv: fix integer overflow on buff_pos
Fixing an integer overflow present
ghsa_unreviewed·2026-05-28
CVE-2026-46198 GHSA-633g-3jmf-hx7h: In the Linux kernel, the following vulnerability has been resolved:
batman-adv: fix integer overflow on buff_pos
Fixing an integer overflow present
In the Linux kernel, the following vulnerability has been resolved:
batman-adv: fix integer overflow on buff_pos
Fixing an integer overflow present in batadv_iv_ogm_send_to_if. The size
check is done using the int type in batadv_iv_ogm_aggr_packet whereas the
buff_pos variable uses the s16 type. This could lead to an out-of-bound
read.
Red Hat
kernel: batman-adv: fix integer overflow on buff_pos
vendor_redhat·2026-05-28
CVE-2026-46198 CWE-190 kernel: batman-adv: fix integer overflow on buff_pos
kernel: batman-adv: fix integer overflow on buff_pos
A flaw was found in the Linux kernel's batman-adv component. An integer overflow in the `batadv_iv_ogm_send_to_if` function, specifically with the `buff_pos` variable, can lead to an out-of-bound read. This occurs because the size check uses an `int` type while `buff_pos` uses an `s16` type, causing a mismatch that could be exploited by a local attacker.
Package: kernel (Red Hat Enterprise Linux 10) - Not affected
Package: kernel (Red Hat Enterprise Linux 6) - Not affected
Package: kernel (Red Hat Enterprise Linux 7) - Not affected
Package: kernel-rt (Red Hat Enterprise Linux 7) - Not affected
Package: kernel (Red Hat Enterprise Linux 8) - Not affected
Package: kernel-rt (Red Hat Enterprise Linux 8) - Not affected
Package: kernel
Red Hat
kernel: EFI/CPER: don't go past the ARM processor CPER record buffer
vendor_redhat·2026-05-06·CVSS 7.0
CVE-2026-43266 [MEDIUM] CWE-130 kernel: EFI/CPER: don't go past the ARM processor CPER record buffer
kernel: EFI/CPER: don't go past the ARM processor CPER record buffer
In the Linux kernel, the following vulnerability has been resolved:
EFI/CPER: don't go past the ARM processor CPER record buffer
There's a logic inside GHES/CPER to detect if the section_length
is too small, but it doesn't detect if it is too big.
Currently, if the firmware receives an ARM processor CPER record
stating that a section length is big, kernel will blindly trust
section_length, producing a very long dump. For instance, a 67
bytes record with ERR_INFO_NUM set 46198 and section length
set to 854918320 would dump a lot of data going a way past the
firmware memory-mapped area.
Fix it by adding a logic to prevent it to go past the buffer
if ERR_INFO_NUM is too big, making it report instead:
[Hardware Error]: Hardw
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-46198 kernel: batman-adv: fix integer overflow on buff_pos
bugzilla·2026-05-28
CVE-2026-46198 CVE-2026-46198 kernel: batman-adv: fix integer overflow on buff_pos
CVE-2026-46198 kernel: batman-adv: fix integer overflow on buff_pos
In the Linux kernel, the following vulnerability has been resolved:
batman-adv: fix integer overflow on buff_pos
Fixing an integer overflow present in batadv_iv_ogm_send_to_if. The size
check is done using the int type in batadv_iv_ogm_aggr_packet whereas the
buff_pos variable uses the s16 type. This could lead to an out-of-bound
read.
Discussion:
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2026052831-CVE-2026-46198-8c9b@gregkh/T
Bugzilla
CVE-2026-43266 kernel: EFI/CPER: don't go past the ARM processor CPER record buffer
bugzilla·2026-05-06
CVE-2026-43266 [MEDIUM] CVE-2026-43266 kernel: EFI/CPER: don't go past the ARM processor CPER record buffer
CVE-2026-43266 kernel: EFI/CPER: don't go past the ARM processor CPER record buffer
In the Linux kernel, the following vulnerability has been resolved:
EFI/CPER: don't go past the ARM processor CPER record buffer
There's a logic inside GHES/CPER to detect if the section_length
is too small, but it doesn't detect if it is too big.
Currently, if the firmware receives an ARM processor CPER record
stating that a section length is big, kernel will blindly trust
section_length, producing a very long dump. For instance, a 67
bytes record with ERR_INFO_NUM set 46198 and section length
set to 854918320 would dump a lot of data going a way past the
firmware memory-mapped area.
Fix it by adding a logic to prevent it to go past the buffer
if ERR_INFO_NUM is too big, making it report instead:
[Ha
https://git.kernel.org/stable/c/0799e5943611006b346b8813c7daf7dd5aa26bfdhttps://git.kernel.org/stable/c/10bb1f366d884d506c38a947b43026a75d1afe9ahttps://git.kernel.org/stable/c/867cd090760e8f5cd206f387b47ff9c56fac04e9https://git.kernel.org/stable/c/96c9c0ed9a9579a9085765aceaa4556a6666eb82https://git.kernel.org/stable/c/974542d1efc48b7e9fe16184e647615cba39969bhttps://git.kernel.org/stable/c/b252797bfced986d6d92ec2f4cfcca842ce8aa78https://git.kernel.org/stable/c/bf872db54f91ffe70104b98c20068b2d5910e018https://git.kernel.org/stable/c/f61499359fa529f0d45a53bf7c573a49eb6322e6
2026-05-28
Published