In the Linux kernel, the following vulnerability has been resolved: batman-adv: fix integer overflow on buff_pos Fixing an integer overflow present in batadv_iv_ogm_send_to_if. The size check is done using the int type in batadv_iv_ogm_aggr_packet whereas the buff_pos variable uses the s16 type. This could lead to an out-of-bound read.

A flaw was found in the Linux kernel's batman-adv component. An integer overflow in the `batadv_iv_ogm_send_to_if` function, specifically with the `buff_pos` variable, can lead to an out-of-bound read. This occurs because the size check uses an `int` type while `buff_pos` uses an `s16` type, causing a mismatch that could be exploited by a local attacker.

Red Hat Enterprise Linux 10 Not affected kernel Red Hat Enterprise Linux 6 Not affected kernel Red Hat Enterprise Linux 7 Not affected kernel Red Hat Enterprise Linux 7 Not affected kernel-rt Red Hat Enterprise Linux 8 Not affected kernel Red Hat Enterprise Linux 8 Not affected kernel-rt Red Hat Enterprise Linux 9 Not affected kernel Red Hat Enterprise Linux 9 Not affected kernel-rt https://www.cve.org/CVERecord?id=CVE-2026-46198 https://nvd.nist.gov/vuln/detail/CVE-2026-46198 https://lore.kernel.org/linux-cve-announce/2026052831-CVE-2026-46198-8c9b@gregkh/T