A buffer overflow condition in the batman-adv module occurs when On-Mesh Gateway (OGM) aggregation is toggled at runtime and a forwarded packet has been allocated only with packet_len bytes. Subsequent packets may still be selected for aggregation, and when the kernel attempts to append them, the skb_put operation can overflow if the packet’s tailroom is insufficient. This incorrect memory handling is an instance of CWE‑131 and could potentially allow a local attacker to overwrite kernel memory, leading to privilege escalation or denial of service.

All Linux kernel installations that include the batman-adv module and have not yet applied the patch for CVE‑2026‑31683 are affected. No specific kernel version range is listed, so any kernel variant that implements batman-adv without the fix is potentially vulnerable.

The vulnerability has a CVSS score of 7.8, indicating high severity. The EPSS score is less than 1 %, suggesting a low probability that the flaw is actively exploited. The vulnerability is not listed in CISA’s KEV catalog. Because the flaw is a local kernel buffer overflow, the likely attack vector requires access to the batman‑adv network interface, implying a local or privileged network attacker. No public exploitation or exploitability analysis is documented in the provided data.