The kernel’s batman-adv module accepts a multicast TVLV without validating that the calculated end offset remains within the 16‑bit range reserved for transport and network header fields. When an offset exceeds this maximum, the kernel’s skb_set_transport_header() truncates the value so that the transport header precedes the network header, producing a negative difference. The batadv_mcast_forw_packet() routine interprets this as an oversized tracker and subsequently reads memory past the skb data, potentially exposing kernel memory contents or causing a crash. The vulnerability is a classic out‑of‑bounds read rooted in insufficient bounds checking of packet header offsets.

The flaw originates in the Linux kernel's batman-adv implementation and affects all builds that include this module. No specific kernel release or product version limitations are documented in the provided data; therefore, any Linux deployment running batman-adv is potentially affected.

The issue allows a remote attacker, able to inject crafted multicast TVLV packets into the network path, to trigger memory corruption or information disclosure. No EPSS value is supplied, and the vulnerability is not listed in CISA’s KEV catalog, yet the lack of bounds checking suggests a high severity risk. Exploitation would require network access to the target system and presence of the batman-adv stack.