Security readout for executives and security teams
Plain-English summary
A Linux batman-adv mesh-networking flaw can make the kernel read beyond an intended memory buffer. An adjacent attacker may be able to trigger it without credentials or user interaction. Potential consequences are serious, but the supplied sources do not establish practical exploitation outcomes.
Executive priority
Prioritize remediation for mesh infrastructure and appliances using batman-adv. Treat other Linux systems as lower priority only after confirming the component is not active. Do not interpret the high score as evidence of active exploitation.
Technical view
An int-sized bounds check in batadv_iv_ogm_aggr_packet does not safely constrain the s16 buff_pos used by batadv_iv_ogm_send_to_if. Integer overflow can therefore produce an out-of-bounds read. CVSS 3.1 rates adjacent, low-complexity, unauthenticated exploitation at 8.8.
Likely exposure
Exposure is most likely on Linux systems actively using batman-adv with a vulnerable kernel, including mesh nodes and embedded networking appliances. The adjacent-network vector means ordinary internet reachability alone does not establish exposure. The supplied version metadata is insufficiently structured for reliable package-level decisions.
Exploitation context
The bundle marks this CVE as absent from KEV and supplies no evidence of active exploitation or a public exploit. The CVSS vector indicates no privileges or user interaction are required, but an attacker must have adjacent-network access.
Researcher notes
No CWE is supplied. The disclosed root cause supports an out-of-bounds read, while the CVSS vector assesses high confidentiality, integrity, and availability impact. Exact affected and corrected release boundaries remain ambiguous in the flattened version data; validate branch-specific status against vendor guidance and referenced commits.
Mitigation direction
- Apply a vendor kernel update containing the appropriate referenced stable fix for the deployed branch.
- Consult the distribution or appliance vendor for corrected package versions and reboot requirements.
- If patching is delayed, assess safely disabling unused batman-adv functionality under vendor guidance.
Validation and detection
- Inventory the running kernel and vendor package version, not merely installed kernel packages.
- Determine whether batman-adv is present, loaded, and actively configured on each system.
- Confirm the installed update incorporates the referenced fix for its exact stable branch.
- Review kernel logs for related memory faults; their absence does not prove non-exploitation.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2026-46198 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H2.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
8.8HighVector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/867cd090760e8f5cd206f387b47ff9c56fac04e9CVE reference, Linux
- https://git.kernel.org/stable/c/10bb1f366d884d506c38a947b43026a75d1afe9aCVE reference, Linux
- https://git.kernel.org/stable/c/96c9c0ed9a9579a9085765aceaa4556a6666eb82CVE reference, Linux
- https://git.kernel.org/stable/c/f61499359fa529f0d45a53bf7c573a49eb6322e6CVE reference, Linux
- https://git.kernel.org/stable/c/974542d1efc48b7e9fe16184e647615cba39969bCVE reference, Linux
- https://git.kernel.org/stable/c/bf872db54f91ffe70104b98c20068b2d5910e018CVE reference, Linux
- https://git.kernel.org/stable/c/b252797bfced986d6d92ec2f4cfcca842ce8aa78CVE reference, Linux
- https://git.kernel.org/stable/c/0799e5943611006b346b8813c7daf7dd5aa26bfdCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.