9.8

CVE-2026-31659: linux

CVSS: 9.8v3.1CriticalAnalyzed
AliasesUBUNTU-CVE-2026-31659DEBIAN-CVE-2026-31659
Published 24-04-2026Last modified 16-10-2026
Open JSON

Vulnerability summary

CVE-2026-31659 is a critical (CVSS 9.8) vulnerability in linux. EPSS estimates a 0.42% chance of exploitation in the next 30 days, higher than 35% of scored vulnerabilities.

Overall risk
70/100
0100
High · default modelHow is this calculated?
CVSS score
9.8/10
010
Critical · v3.1 (CVE.org)
EPSS score
0.42%
0%100%
Low · +0.02 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 39 · Related 50
LSN-0121-1MGASA-2026-0108MGASA-2026-0110OPENSUSE-SU-2026:21555-1SUSE-SU-2026:23066-1SUSE-SU-2026:23068-1

Timeline

  1. 24-04-2026
    PublishedVulnerability first disclosed.
  2. 16-10-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: batman-adv: reject oversized global TT response buffers batadv_tt_prepare_tvlv_global_data() builds the allocation length for a global TT response in 16-bit temporaries. When a remote originator advertises a large enough global TT, the TT payload length plus the VLAN header offset can exceed 65535 and wrap before kmalloc(). The full-table response path still uses the original TT payload length when it fills tt_change, so the wrapped allocation is too small and batadv_tt_prepare_tvlv_global_data() writes past the end of the heap object before the later packet-size check runs. Fix this by rejecting TT responses whose TVLV value length cannot fit in the 16-bit TVLV payload length field.

CVSS metrics

5 scores · 4 sources · 2 versions

EPSS trend

Probability

0.42%

Chance of exploitation in the next 30 days

Percentile

35%

Versus all other CVEs

30-day change

+0.02 pp

From 0.40% on 19-09-2026

19-09-202619-10-2026
EPSS score
0.42%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Ubuntu157 products
  • linux< 3.13.0-215.266 | < 4.4.0-283.317 | < 4.15.0-253.265 | < 5.4.0-233.253 | < 5.15.0-185.195 | < 6.8.0-134.134 | < 6.17.0-40.40
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-aws< 4.4.0-1156.162 | < 4.4.0-1194.209 | < 4.15.0-1194.207 | < 5.4.0-1161.172 | < 5.15.0-1111.118 | < 6.8.0-1060.63 | < 6.17.0-1019.19
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Linux2 products
  • linux≥ 7ea7b4a142758deaf46c1af0ca9ceca6dd55138b, < 7e5d007e0df946bffb8542fb112e0044014a5897 | ≥ 7ea7b4a142758deaf46c1af0ca9ceca6dd55138b, < 2997f4bd1f982e7013709946e00be89b507693fa | ≥ 7ea7b4a142758deaf46c1af0ca9ceca6dd55138b, < 95c71365a2222908441b54d6f2c315e0c79fcec3 | ≥ 7ea7b4a142758deaf46c1af0ca9ceca6dd55138b, < 69d61639bc7e963c3b645e570279d731e7c89062 | ≥ 7ea7b4a142758deaf46c1af0ca9ceca6dd55138b, < f970646b9a39539d1bac86822ac78b5915455ea9 | ≥ 7ea7b4a142758deaf46c1af0ca9ceca6dd55138b, < de6c1dc3c7d01a152607e6fcecee4d5288283f10 | ≥ 7ea7b4a142758deaf46c1af0ca9ceca6dd55138b, < cf2199171ef799ca7270019125f4a91bd20ad4d9 | ≥ 7ea7b4a142758deaf46c1af0ca9ceca6dd55138b, < 3a359bf5c61d52e7f09754108309d637532164a6 | 3.13
  • linux_kernel≥ 3.13.1, < 5.10.253 | ≥ 5.11, < 5.15.203 | ≥ 5.16, < 6.1.169 | ≥ 6.2, < 6.6.135 | ≥ 6.7, < 6.12.82 | ≥ 6.13, < 6.18.23 | ≥ 6.19, < 6.19.13 | 3.13 | 7.0:rc1 | 7.0:rc2 | 7.0:rc3 | 7.0:rc4 | 7.0:rc5 | 7.0:rc6 | 7.0:rc7
Debian1 product
  • linux< 6.1.170-1 | < 6.12.85-1 | < 6.19.13-1

3 vendors · 160 products

References

51 links
Show all 51 references