CVE-2026-63834 (GCVE-0-2026-63834)

Vulnerability from cvelistv5 – Published: 2026-07-19 12:02 – Updated: 2026-07-19 12:02
VLAI
Title
batman-adv: tp_meter: restrict number of unacked list entries
Summary
In the Linux kernel, the following vulnerability has been resolved: batman-adv: tp_meter: restrict number of unacked list entries When the unacked_list is unbound, an attacker could send messages with small lengths and appropriated seqno + gaps to force the receiver to allocate more and more unacked_list entries. And the end either causing an out-of-memory situation or increase the management overhead for the (large) list that significant portions of CPU cycles are wasted in searching through the list. When limiting the list to a specific number, it is important to still correctly add a new entry to the list. But if the list became larger than the limit, the last entry of the list (with the highest seqno) must be dropped to still allow the earlier seqnos to finish and therefore to continue the process. Otherwise, the process might get stuck with too high seqnos which are not handled by batadv_tp_ack_unordered().
Severity
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 33a3bb4a3345bb511f9c69c913da95d4693e2a4e , < 31a88792bfba142be3c9521538c1db805677381f (git)
Affected: 33a3bb4a3345bb511f9c69c913da95d4693e2a4e , < 1111a3381bca2d1f084a07686bc783af5ab23df7 (git)
Affected: 33a3bb4a3345bb511f9c69c913da95d4693e2a4e , < 1c616b0be4bd8399d485e25e91859373b95d6013 (git)
Affected: 33a3bb4a3345bb511f9c69c913da95d4693e2a4e , < f8c499fd275e59203b77fca76ae6ef2d096c2133 (git)
Affected: 33a3bb4a3345bb511f9c69c913da95d4693e2a4e , < c6231d628d06d841bc1617b2f7034f5f39876b16 (git)
Affected: 33a3bb4a3345bb511f9c69c913da95d4693e2a4e , < 2233787658db859f0a9b83cb397cf783bb8be865 (git)
Affected: 33a3bb4a3345bb511f9c69c913da95d4693e2a4e , < 1fb8762600a393d1caccd63be5d07e1756982d68 (git)
Affected: 33a3bb4a3345bb511f9c69c913da95d4693e2a4e , < e7c775110e1858e5a7471a23a9c9658c0af9df89 (git)
Create a notification for this product.
Linux Linux Affected: 4.8
Unaffected: 0 , < 4.8 (semver)
Unaffected: 5.10.260 , ≤ 5.10.* (semver)
Unaffected: 5.15.211 , ≤ 5.15.* (semver)
Unaffected: 6.1.177 , ≤ 6.1.* (semver)
Unaffected: 6.6.144 , ≤ 6.6.* (semver)
Unaffected: 6.12.95 , ≤ 6.12.* (semver)
Unaffected: 6.18.38 , ≤ 6.18.* (semver)
Unaffected: 7.1.3 , ≤ 7.1.* (semver)
Unaffected: 7.2-rc1 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/batman-adv/tp_meter.c",
            "net/batman-adv/types.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "31a88792bfba142be3c9521538c1db805677381f",
              "status": "affected",
              "version": "33a3bb4a3345bb511f9c69c913da95d4693e2a4e",
              "versionType": "git"
            },
            {
              "lessThan": "1111a3381bca2d1f084a07686bc783af5ab23df7",
              "status": "affected",
              "version": "33a3bb4a3345bb511f9c69c913da95d4693e2a4e",
              "versionType": "git"
            },
            {
              "lessThan": "1c616b0be4bd8399d485e25e91859373b95d6013",
              "status": "affected",
              "version": "33a3bb4a3345bb511f9c69c913da95d4693e2a4e",
              "versionType": "git"
            },
            {
              "lessThan": "f8c499fd275e59203b77fca76ae6ef2d096c2133",
              "status": "affected",
              "version": "33a3bb4a3345bb511f9c69c913da95d4693e2a4e",
              "versionType": "git"
            },
            {
              "lessThan": "c6231d628d06d841bc1617b2f7034f5f39876b16",
              "status": "affected",
              "version": "33a3bb4a3345bb511f9c69c913da95d4693e2a4e",
              "versionType": "git"
            },
            {
              "lessThan": "2233787658db859f0a9b83cb397cf783bb8be865",
              "status": "affected",
              "version": "33a3bb4a3345bb511f9c69c913da95d4693e2a4e",
              "versionType": "git"
            },
            {
              "lessThan": "1fb8762600a393d1caccd63be5d07e1756982d68",
              "status": "affected",
              "version": "33a3bb4a3345bb511f9c69c913da95d4693e2a4e",
              "versionType": "git"
            },
            {
              "lessThan": "e7c775110e1858e5a7471a23a9c9658c0af9df89",
              "status": "affected",
              "version": "33a3bb4a3345bb511f9c69c913da95d4693e2a4e",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/batman-adv/tp_meter.c",
            "net/batman-adv/types.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.8"
            },
            {
              "lessThan": "4.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.260",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.211",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.177",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.144",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.95",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.38",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.260",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.211",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.177",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.144",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.95",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.38",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.3",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2-rc1",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbatman-adv: tp_meter: restrict number of unacked list entries\n\nWhen the unacked_list is unbound, an attacker could send messages with\nsmall lengths and appropriated seqno + gaps to force the receiver to\nallocate more and more unacked_list entries. And the end either causing an\nout-of-memory situation or increase the management overhead for the (large)\nlist that significant portions of CPU cycles are wasted in searching\nthrough the list.\n\nWhen limiting the list to a specific number, it is important to still\ncorrectly add a new entry to the list. But if the list became larger than\nthe limit, the last entry of the list (with the highest seqno) must be\ndropped to still allow the earlier seqnos to finish and therefore to\ncontinue the process. Otherwise, the process might get stuck with too high\nseqnos which are not handled by batadv_tp_ack_unordered()."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-19T12:02:26.045Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/31a88792bfba142be3c9521538c1db805677381f"
        },
        {
          "url": "https://git.kernel.org/stable/c/1111a3381bca2d1f084a07686bc783af5ab23df7"
        },
        {
          "url": "https://git.kernel.org/stable/c/1c616b0be4bd8399d485e25e91859373b95d6013"
        },
        {
          "url": "https://git.kernel.org/stable/c/f8c499fd275e59203b77fca76ae6ef2d096c2133"
        },
        {
          "url": "https://git.kernel.org/stable/c/c6231d628d06d841bc1617b2f7034f5f39876b16"
        },
        {
          "url": "https://git.kernel.org/stable/c/2233787658db859f0a9b83cb397cf783bb8be865"
        },
        {
          "url": "https://git.kernel.org/stable/c/1fb8762600a393d1caccd63be5d07e1756982d68"
        },
        {
          "url": "https://git.kernel.org/stable/c/e7c775110e1858e5a7471a23a9c9658c0af9df89"
        }
      ],
      "title": "batman-adv: tp_meter: restrict number of unacked list entries",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-63834",
    "datePublished": "2026-07-19T12:02:26.045Z",
    "dateReserved": "2026-07-19T07:54:57.015Z",
    "dateUpdated": "2026-07-19T12:02:26.045Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-63834",
      "date": "2026-07-20",
      "epss": "0.00165",
      "percentile": "0.06081"
    },
    "microsoft_vex": {
      "current_release_date": "2026-07-20T01:05:09.000Z",
      "cve": "CVE-2026-63834",
      "id": "msrc_CVE-2026-63834",
      "initial_release_date": "2026-07-20T01:05:09.000Z",
      "product_status:under_investigation": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "batman-adv: tp_meter: restrict number of unacked list entries",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-63834.json",
      "version": "1"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-63834\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-07-19T12:16:56.840\",\"lastModified\":\"2026-07-19T12:16:56.840\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbatman-adv: tp_meter: restrict number of unacked list entries\\n\\nWhen the unacked_list is unbound, an attacker could send messages with\\nsmall lengths and appropriated seqno + gaps to force the receiver to\\nallocate more and more unacked_list entries. And the end either causing an\\nout-of-memory situation or increase the management overhead for the (large)\\nlist that significant portions of CPU cycles are wasted in searching\\nthrough the list.\\n\\nWhen limiting the list to a specific number, it is important to still\\ncorrectly add a new entry to the list. But if the list became larger than\\nthe limit, the last entry of the list (with the highest seqno) must be\\ndropped to still allow the earlier seqnos to finish and therefore to\\ncontinue the process. Otherwise, the process might get stuck with too high\\nseqnos which are not handled by batadv_tp_ack_unordered().\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/batman-adv/tp_meter.c\",\"net/batman-adv/types.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"33a3bb4a3345bb511f9c69c913da95d4693e2a4e\",\"lessThan\":\"31a88792bfba142be3c9521538c1db805677381f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"33a3bb4a3345bb511f9c69c913da95d4693e2a4e\",\"lessThan\":\"1111a3381bca2d1f084a07686bc783af5ab23df7\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"33a3bb4a3345bb511f9c69c913da95d4693e2a4e\",\"lessThan\":\"1c616b0be4bd8399d485e25e91859373b95d6013\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"33a3bb4a3345bb511f9c69c913da95d4693e2a4e\",\"lessThan\":\"f8c499fd275e59203b77fca76ae6ef2d096c2133\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"33a3bb4a3345bb511f9c69c913da95d4693e2a4e\",\"lessThan\":\"c6231d628d06d841bc1617b2f7034f5f39876b16\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"33a3bb4a3345bb511f9c69c913da95d4693e2a4e\",\"lessThan\":\"2233787658db859f0a9b83cb397cf783bb8be865\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"33a3bb4a3345bb511f9c69c913da95d4693e2a4e\",\"lessThan\":\"1fb8762600a393d1caccd63be5d07e1756982d68\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"33a3bb4a3345bb511f9c69c913da95d4693e2a4e\",\"lessThan\":\"e7c775110e1858e5a7471a23a9c9658c0af9df89\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/batman-adv/tp_meter.c\",\"net/batman-adv/types.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.8\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.8\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.260\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.211\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.177\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.144\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.95\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.38\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.3\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2-rc1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/1111a3381bca2d1f084a07686bc783af5ab23df7\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/1c616b0be4bd8399d485e25e91859373b95d6013\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/1fb8762600a393d1caccd63be5d07e1756982d68\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/2233787658db859f0a9b83cb397cf783bb8be865\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/31a88792bfba142be3c9521538c1db805677381f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/c6231d628d06d841bc1617b2f7034f5f39876b16\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/e7c775110e1858e5a7471a23a9c9658c0af9df89\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/f8c499fd275e59203b77fca76ae6ef2d096c2133\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "suse_vex": {
      "aggregate_severity": "not set",
      "current_release_date": "2026-07-19T17:34:30Z",
      "cve": "CVE-2026-63834",
      "id": "CVE-2026-63834",
      "initial_release_date": "2026-07-19T17:34:30Z",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-63834",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-63834.json",
      "version": "2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.