CVE-2026-80839

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

batman-adv: reject unrepresentable multicast TVLV offsets

The network and transport header fields in struct sk_buff are 16-bit

offsets from skb->head, and U16_MAX is reserved as the unset transport

header value. batadv_tvlv_call_handler() sets both fields from a received

multicast TVLV without checking whether the TVLV end is representable.

If the end offset exceeds the field's range, skb_set_transport_header()

truncates it so that the transport header precedes the network header.

The negative difference is then returned by skb_network_header_len() as

a large u32. batadv_mcast_forw_packet() consequently accepts an oversized

multicast tracker and accesses memory beyond the skb data.

Add skb_set_transport_header_careful(), an offset-aware counterpart to

skb_reset_transport_header_careful(), which validates the final

head-relative offset before assigning it. Use the new helper in

batadv_tvlv_call_handler() and reject

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References