UBUNTU-CVE-2026-80839: Medium severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: batman-adv: reject unrepresentable multicast TVLV offsets The network and transport header fields in struct skbuff are 16-bit offsets from skb->head, and U16MAX is reserved as the unset transport header value. batadvtvlvcallhandler() sets both fields from a received multicast TVLV without checking whether the TVLV end is representable. If the end offset exceeds the field's range, skbsettransportheader() truncates it so that the transport header precedes the network header. The negative difference is then returned by skbnetworkheaderlen() as a large u32. batadvmcastforwpacket() consequently accepts an oversized multicast tracker and accesses memory beyond the skb data. Add skbsettransportheadercareful(), an offset-aware counterpart to skbresettransportheadercareful(), which validates the final head-relative offset before assigning it. Use the new helper in batadvtvlvcallhandler() and reject unrepresentable TVLVs before setting the network header.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
Use skb_set_transport_header_careful() in batadv_tvlv_call_handler() and reject multicast TVLVs whose end offset is not representable before setting the network header.
Event History
Frequently Asked Questions
Which Ubuntu kernel packages are listed for this issue?
The listed packages are ubuntu/linux-riscv, ubuntu/linux-realtime, ubuntu/linux-azure, ubuntu/linux-gcp, ubuntu/linux-azure-fde, ubuntu/linux-gke, ubuntu/linux-hwe-edge, and ubuntu/linux-gkeop.
What does an attacker need to send to trigger the vulnerable path?
The vulnerable path processes a received multicast TVLV whose end offset cannot be represented by the 16-bit skb network and transport header fields. The malformed offset can cause the multicast forwarding code to accept an oversized tracker and access memory beyond skb data.