CVE-2026-31683: batman-adv: avoid OGM aggregation when skb tailroom is insufficient
In the Linux kernel, the following vulnerability has been resolved:
batman-adv: avoid OGM aggregation when skb tailroom is insufficient
When OGM aggregation state is toggled at runtime, an existing forwarded
packet may have been allocated with only packet_len bytes, while a later
packet can still be selected for aggregation. Appending in this case can
hit skb_put overflow conditions.
Reject aggregation when the target skb tailroom cannot accommodate the new
packet. The caller then falls back to creating a new forward packet
instead of appending.
Security readout for executives and security teams
Plain-English summary
A flaw in Linux’s batman-adv mesh-networking component can cause a kernel memory overflow when OGM packet aggregation is changed during operation. A successful trigger could compromise confidentiality, integrity, and availability. Exposure is concentrated in systems actively using batman-adv, not all Linux hosts.
Executive priority
Treat as a high-priority infrastructure patch for batman-adv mesh nodes. Ordinary Linux systems not using this component have lower immediate urgency. Require prompt asset identification and vendor-version confirmation because the source bundle does not provide distribution package mappings.
Technical view
After OGM aggregation is toggled, an existing forwarded packet may lack space for a newly aggregated packet. Appending it can trigger an skb_put overflow. The fix checks available skb tailroom and creates a separate forward packet when space is insufficient. The supplied CVSS 3.1 score is 7.8 with local, low-privileged access required.
Likely exposure
Potentially exposed systems run an affected Linux kernel and actively use batman-adv forwarding with runtime OGM aggregation changes. The bundle lists broad affected versions but does not map stable commits to distribution package versions, so vendor-specific verification is required.
Exploitation context
The supplied CVSS vector indicates local access, low privileges, low complexity, and no user interaction. CISA KEV status is false, and the bundle provides no evidence of active exploitation or a public exploit. Practical reachability beyond the stated conditions remains unconfirmed.
Researcher notes
The defect is an insufficient tailroom check during OGM aggregation after runtime state changes. Stable patches reject unsafe aggregation and use the existing new-packet fallback. The CVSS impact claims are severe, but the bundle does not document demonstrated code execution, crash reproduction, exploit availability, or exploitation in the wild.
Mitigation direction
Install the vendor kernel update containing the applicable stable fix.
Consult the Linux distribution vendor for exact fixed package versions.
If updates are unavailable, request a vendor-supported workaround; none is identified in the bundle.
Prioritize systems actively using batman-adv mesh forwarding.
Validation and detection
Identify systems where batman-adv is present and actively forwarding traffic.
Determine whether OGM aggregation is changed during runtime.
Map each running kernel to its distribution advisory or applicable stable fix commit.
After updating, confirm the fixed kernel is running and batman-adv services operate normally.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Potential ATT&CK relevance
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
cve · low confidence lookup
CVE-2026-31683 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
1CVSS vectors
3Timeline events
0ADP providers
9Source links
CVSS vector scores
1 official score
We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.