The batman‑adv networking layer in the Linux kernel misdeclares a 16‑bit length field that should only store non‑negative values. When a value larger than 32767 is written, the signed field wraps around to a negative number. This sign‑extended negative value is later used to size a buffer, resulting in allocation of a large buffer that is only partially initialized. The remaining memory remains uninitialized, creating an opportunity for an attacker to read or potentially execute data that was never set, thereby compromising confidentiality or integrity of kernel data.

Any Linux kernel build that contains the batman‑adv module in its unpatched state is affected. The vulnerability exists in all releases that still include the original batman‑adv TT handling code. The patch resides in the commit history referenced in the advisory, so any kernel version that does not contain those commits is vulnerable.

This flaw carries a CVSS base score of 9.8, indicating high severity. The EPSS score is less than 1 % and the issue is not listed in the CISA KEV catalog, suggesting a low likelihood of exploitation at present. Based on the description, it is inferred that an attacker would need to deliver a specially crafted batman‑adv TT response packet to a vulnerable node, making the attack a remote network exploitation scenario that requires the batman‑adv service to be reachable from the attacker’s network.