The vulnerability stems from a signedness mismatch in the batman-adv multi-hop virtual switch component of the Linux kernel. A 16-bit signed field, batadv_orig_node::tt_buff_len, is incorrectly allowed to hold values larger than 32767, causing the value to wrap to a negative number. When this field is promoted to a 32-bit signed integer during tt_buff_len handling, the negative sign extension propagates into buffer allocation logic. The code allocates a full-size buffer based on the misinterpreted length but only populates a small portion of it, leaving the remainder uninitialized. The presence of uninitialized memory in the buffer can allow an attacker to read data that was not intended to be exposed, resulting in information disclosure.

This issue affects any Linux system whose kernel includes the batman-adv module, regardless of distribution or kernel release, as long as the module is compiled into the kernel. Any unpatched kernel that ships batman-adv is potentially vulnerable, and systems that do not use batman-adv effectively expose themselves to no additional risk beyond the default kernel.

The CVSS score of 8.8 classifies the vulnerability as high severity, but the EPSS score of less than 1% suggests that exploitation likelihood is currently very low. The vulnerability is not listed in CISA's KEV catalogue. The likely attack vector involves network traffic: an attacker must be able to inject malformed packets into a network segment that a batman-adv node processes. Such an intrusion would require proximity or compromised routers within the same multi-hop domain. While the high severity indicates significant impact if exploited, the need for specialized network access and low current exploitation probability reduce the immediate threat.