CVE-2026-63834— batman-adv: tp_meter: restrict number of unacked list entries
Affected Version Matrix 18
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Linux | Linux | 33a3bb4a3345bb511f9c69c913da95d4693e2a4e< 31a88792bfba142be3c9521538c1db805677381f | affected |
33a3bb4a3345bb511f9c69c913da95d4693e2a4e< 1111a3381bca2d1f084a07686bc783af5ab23df7 | affected | ||
33a3bb4a3345bb511f9c69c913da95d4693e2a4e< 1c616b0be4bd8399d485e25e91859373b95d6013 | affected | ||
33a3bb4a3345bb511f9c69c913da95d4693e2a4e< f8c499fd275e59203b77fca76ae6ef2d096c2133 | affected | ||
33a3bb4a3345bb511f9c69c913da95d4693e2a4e< c6231d628d06d841bc1617b2f7034f5f39876b16 | affected | ||
33a3bb4a3345bb511f9c69c913da95d4693e2a4e< 2233787658db859f0a9b83cb397cf783bb8be865 | affected | ||
33a3bb4a3345bb511f9c69c913da95d4693e2a4e< 1fb8762600a393d1caccd63be5d07e1756982d68 | affected | ||
33a3bb4a3345bb511f9c69c913da95d4693e2a4e< e7c775110e1858e5a7471a23a9c9658c0af9df89 | affected | ||
| … +10 more rows | |||
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-63834
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
batman-adv: tp_meter: restrict number of unacked list entries
Source: NVD (National Vulnerability Database)
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: batman-adv: tp_meter: restrict number of unacked list entries When the unacked_list is unbound, an attacker could send messages with small lengths and appropriated seqno + gaps to force the receiver to allocate more and more unacked_list entries. And the end either causing an out-of-memory situation or increase the management overhead for the (large) list that significant portions of CPU cycles are wasted in searching through the list. When limiting the list to a specific number, it is important to still correctly add a new entry to the list. But if the list became larger than the limit, the last entry of the list (with the highest seqno) must be dropped to still allow the earlier seqnos to finish and therefore to continue the process. Otherwise, the process might get stuck with too high seqnos which are not handled by batadv_tp_ack_unordered().
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
N/A
Source: NVD (National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-63834
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-63834
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-63834 (8)
Same Patch Batch · Linux · 2026-07-19 · 431 CVEs total
| CVE-2026-63905 | usbip: vudc: Fix use after free bug in vudc_remove due to race condition | |
| CVE-2026-63891 | thunderbolt: property: Cap recursion depth in __tb_property_parse_dir() | |
| CVE-2026-63892 | thunderbolt: property: Reject dir_len < 4 to prevent size_t underflow | |
| CVE-2026-63893 | thunderbolt: property: Reject u32 wrap in tb_property_entry_valid() | |
| CVE-2026-63895 | usb: gadget: f_fs: copy only received bytes on short ep0 read | |
| CVE-2026-63894 | usb: gadget: f_fs: serialize DMABUF cancel against request completion | |
| CVE-2026-63896 | usb: gadget: composite: fix integer underflow in WebUSB GET_URL handling | |
| CVE-2026-63897 | USB: serial: mct_u232: fix missing interrupt-in transfer sanity check | |
| CVE-2026-63898 | USB: serial: mct_u232: fix memory corruption with small endpoint | |
| CVE-2026-63899 | USB: serial: mxuport: fix memory corruption with small endpoint | |
| CVE-2026-63900 | USB: serial: keyspan: fix missing indat transfer sanity check | |
| CVE-2026-63901 | USB: serial: digi_acceleport: fix memory corruption with small endpoints | |
| CVE-2026-63902 | USB: serial: cypress_m8: validate interrupt packet headers | |
| CVE-2026-63903 | USB: serial: belkin_sa: validate interrupt status length | |
| CVE-2026-63914 | xfrm: route MIGRATE notifications to caller's netns | |
| CVE-2026-63911 | xfrm: iptfs: reset runtime state when cloning SAs | |
| CVE-2026-63912 | xfrm: esp: restore combined single-frag length gate | |
| CVE-2026-63913 | netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check | |
| CVE-2026-63910 | dma-buf: fix UAF in dma_buf_fd() tracepoint | |
| CVE-2026-63915 | nfc: hci: fix out-of-bounds read in HCP header parsing |
Showing top 20 of 431 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Linux
- CVE-2026-64186
iommu/amd: Remove latent out-of-bounds access in IOMMU debug - CVE-2026-64184
mm/damon/sysfs-schemes: call missing mem_cgroup_iter_break() - CVE-2026-64185
sysfs: don't remove existing directory on update failure - CVE-2026-64183
efi: Allocate runtime workqueue before ACPI init - CVE-2026-64182
drivers/base/memory: fix memory block reference leak in pois
Same vendor: Linux
- CVE-2026-64186
iommu/amd: Remove latent out-of-bounds access in IOMMU debug - CVE-2026-64184
mm/damon/sysfs-schemes: call missing mem_cgroup_iter_break() - CVE-2026-64185
sysfs: don't remove existing directory on update failure - CVE-2026-64183
efi: Allocate runtime workqueue before ACPI init - CVE-2026-64182
drivers/base/memory: fix memory block reference leak in pois
V. Comments for CVE-2026-63834
No comments yet