The Linux kernel’s batman‑adv traffic tunnelling module mis‑declares a 16‑bit length field for the TT changeset that should never be negative. When a value larger than 32767 is written, the signed field wraps to a negative number. This sign‑extended value is later used to allocate a buffer large enough for the full length, but only a small portion of the buffer is populated, leaving the rest uninitialized. The uninitialized memory can expose confidential kernel data or allow further corruption if the attacker can influence the buffer’s content, effectively creating a memory corruption vulnerability.

The vulnerability exists in the batman‑adv module of the Linux kernel. Known affected versions are the 7.1 release candidates rc1 through rc4, as indicated by the CPE strings in the CVE data. Other kernel releases that still contain the original unpatched TT handling code may also be affected, but this is an inference based on typical kernel development practices and is not explicitly declared in the CVE report.

The base CVSS score of 9.8 signals high severity, but the EPSS score is less than 1 % and the issue is not listed in the CISA KEV catalog, indicating a low current exploitation probability. Based on the description, it is inferred that an attacker would need to deliver a specially crafted batman‑adv TT response packet to a vulnerable node over the network, making the attack a remote network exploitation scenario that requires the batman‑adv service to be reachable. Exploitation would involve inducing the negative length, causing uninitialized memory usage, and potentially leaking or corrupting sensitive kernel data.