In the Linux kernel, the following vulnerability has been resolved: batman-adv: tt: prevent TVLV OOB check overflow A TT unicast TVLV c…
CVE-2026-72226 · published 15 Aug 2026
How serious is it
- Severity: critical, CVSS score 9.8 out of 10.
- No exploit prediction (EPSS) score yet.
- Not on the CISA list of exploited vulnerabilities.
- No public exploit in Exploit-DB.
Is your app affected by CVE-2026-72226?
Paste this prompt into Claude Code, Cursor or any AI coding tool: it runs a free Shippable scan of your project and fixes what it finds. Built with Lovable, Bolt or v0? Scan your live app. Or upload your package file.
Who is affected
- Linux Linux: 3.13
How to check
- Find out whether you run the affected product and which version, then compare it with the versions above.
How to fix
Copies a prompt for Claude Code, Cursor or Codex that asks it to check whether you run this product.
- Apply the vendor's update or mitigation from the references below. If there is none yet, limit exposure of the affected service until there is.
- If a vulnerable version was live, check your logs and rotate the secrets that server could read.
The advisory
In the Linux kernel, the following vulnerability has been resolved:
batman-adv: tt: prevent TVLV OOB check overflow
A TT unicast TVLV contains the number of VLANs stored in it. This number is
an u16 and gets multiplied by the size of the struct
batadv_tvlv_tt_vlan_data (8 bytes). The size can therefore overflow the u16
used to store the tt_vlan_len. All additional safety checks to prevent
out-of-bounds access of the TVLV buffer are invalid due to this overflow.
Using size_t prevents this overflow and ensures that the safety checks
compare against the actual buffer requirements.
Check your whole app
Dependencies are only half of it. Free and read-only: before you push, run npx shippable-dev scan localhost:3000 in your project folder, no account needed. For your live app, you prove it's yours with a one-line tag first.
References
- git.kernel.org/stable/c/0de12a4c4847f571d82a9cd96bc633eded41d7c6
- git.kernel.org/stable/c/1898273c5dc8148267ef9f97cd2517a2822350e7
- git.kernel.org/stable/c/3256c05d5a9db34346eaf20f52dddde984852d77
- git.kernel.org/stable/c/604bd5042fbcd1ab9f7cd98fd847ec017aeede8a
- git.kernel.org/stable/c/6222b443686525cb5a9b6a9cecf23b2e2ab23e2a
- git.kernel.org/stable/c/7319c0794f91be2734aac695794e7203606b49f8
- git.kernel.org/stable/c/7a581d9aaba8c82bd6177fa36b2588eea77f6e2b
- git.kernel.org/stable/c/d6ff4764ff784ede25f5c83a6f5883a74c93a5ea
Merged from NVD. Last updated 23 Oct 2026. All vulnerabilities · RSS · JSON