An integer overflow exists in the batman-adv networking subsystem, specifically within the batadv_iv_ogm_send_to_if function. The buffer position index uses a 16‑bit signed type, while the size check employs a 32‑bit signed type, allowing an out‑of‑bounds read of kernel memory. The effect is the exposure of privileged kernel data without crashing the operating system, representing a potential confidentiality breach.

All Linux kernel releases that ship the batman‑adv module before the patch commit are vulnerable. The CNA lists the kernel as the affected product, but does not specify particular versions, so any kernel incorporating the unpatched batadv code is at risk.

The CVSS score is 8.8. The EPSS score is reported as less than 1%, and the vulnerability is not listed in the CISA KEV catalog, indicating a low likelihood of public exploitation at this time. However, the vulnerability allows an attacker to read arbitrary kernel memory which carries high impact if exploited. Based on the function involved, the likely attack vector is a crafted OGM packet received via the batman‑adv interface, though explicit exploitation evidence is not documented.