Signed to Unsigned Conversion Error in Linux kernel - CVE-2026-64089
Published: July 20, 2026
Vulnerability identifier: #VU138552
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2026-64089
CWE-ID: CWE-195
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vendor: Linux Foundation
Affected software:
Linux kernel
Linux kernel
Detailed vulnerability description
The vulnerability allows a local user to disclose sensitive information.
The vulnerability exists due to an integer signedness error in batadv_send_my_tt_response() and batadv_tt_prepare_tvlv_local_data() when processing a translation table changeset length value larger than 32767. A local user can trigger the vulnerable code path to disclose sensitive information.
The issue occurs because a negative sign-extended length can cause a full-sized buffer to be allocated while only a small portion is populated, leaving the remaining bytes uninitialized.
How to mitigate CVE-2026-64089
Install security update from vendor's repository.
Sources
- https://git.kernel.org/stable/c/179eb62506a02d00370bd6478898cb632e10986c
- https://git.kernel.org/stable/c/22d59c72f4a47ffec121d0610f70d0d70c3c11c8
- https://git.kernel.org/stable/c/55dc41fe8821e9a849e147255ad572bc933a9d15
- https://git.kernel.org/stable/c/6314089acf0ddf64376fdc0b1420695504c73f52
- https://git.kernel.org/stable/c/c424e8519ac78eac5d9f4eecf06208a0d619ec14
- https://git.kernel.org/stable/c/d29abf70c665730e249d2ec8e1402095ae26bcee
- https://git.kernel.org/stable/c/eb235472b52ef36981c5aad330485eaf2382c53b
- https://git.kernel.org/stable/c/fc92cdfcb295cefa4344d71a527d61b638b7bfc4