LiveActive security incident?Get immediate response
CVE Record

CVE-2026-31683: batman-adv: avoid OGM aggregation when skb tailroom is insufficient

In the Linux kernel, the following vulnerability has been resolved: batman-adv: avoid OGM aggregation when skb tailroom is insufficient When OGM aggregation state is toggled at runtime, an existing forwarded packet may have been allocated with only packet_len bytes, while a later packet can still be selected for aggregation. Appending in this case can hit skb_put overflow conditions. Reject aggregation when the target skb tailroom cannot accommodate the new packet. The caller then falls back to creating a new forward packet instead of appending.

HighCVSS 7.8Not KEV-listedUpdated
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

A flaw in Linux’s batman-adv mesh-networking component can cause a kernel memory overflow when OGM packet aggregation is changed during operation. A successful trigger could compromise confidentiality, integrity, and availability. Exposure is concentrated in systems actively using batman-adv, not all Linux hosts.

Executive priority

Treat as a high-priority infrastructure patch for batman-adv mesh nodes. Ordinary Linux systems not using this component have lower immediate urgency. Require prompt asset identification and vendor-version confirmation because the source bundle does not provide distribution package mappings.

Technical view

After OGM aggregation is toggled, an existing forwarded packet may lack space for a newly aggregated packet. Appending it can trigger an skb_put overflow. The fix checks available skb tailroom and creates a separate forward packet when space is insufficient. The supplied CVSS 3.1 score is 7.8 with local, low-privileged access required.

Likely exposure

Potentially exposed systems run an affected Linux kernel and actively use batman-adv forwarding with runtime OGM aggregation changes. The bundle lists broad affected versions but does not map stable commits to distribution package versions, so vendor-specific verification is required.

Exploitation context

The supplied CVSS vector indicates local access, low privileges, low complexity, and no user interaction. CISA KEV status is false, and the bundle provides no evidence of active exploitation or a public exploit. Practical reachability beyond the stated conditions remains unconfirmed.

Researcher notes

The defect is an insufficient tailroom check during OGM aggregation after runtime state changes. Stable patches reject unsafe aggregation and use the existing new-packet fallback. The CVSS impact claims are severe, but the bundle does not document demonstrated code execution, crash reproduction, exploit availability, or exploitation in the wild.

Mitigation direction

  • Install the vendor kernel update containing the applicable stable fix.
  • Consult the Linux distribution vendor for exact fixed package versions.
  • If updates are unavailable, request a vendor-supported workaround; none is identified in the bundle.
  • Prioritize systems actively using batman-adv mesh forwarding.

Validation and detection

  • Identify systems where batman-adv is present and actively forwarding traffic.
  • Determine whether OGM aggregation is changed during runtime.
  • Map each running kernel to its distribution advisory or applicable stable fix commit.
  • After updating, confirm the fixed kernel is running and batman-adv services operate normally.
Prepared
Confidence
medium
Sources
10

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2026-31683 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.8 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
0ADP providers
9Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.8CVSS 3.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9Linux

Vulnerability scoring details

Base CVSS 3.1 score

7.8High
CVSS 3.1 vector shape for CVE-2026-31683Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxc6c8fea29769d998d94fcec9b9f14d4b52b349d3, c6c8fea29769d998d94fcec9b9f14d4b52b349d3, c6c8fea29769d998d94fcec9b9f14d4b52b349d3, c6c8fea29769d998d94fcec9b9f14d4b52b349d3, c6c8fea29769d998d94fcec9b9f14d4b52b349d3, c6c8fea29769d998d94fcec9b9f14d4b52b349d3, c6c8fea29769d998d94fcec9b9f14d4b52b349d3, c6c8fea29769d998d94fcec9b9f14d4b52b349d3unaffected
LinuxLinux2.6.38, 0, 5.10.253, 5.15.203, 6.1.167, 6.6.130, 6.12.78, 6.18.20, 6.19.10, 7.0affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.