CVE-2026-63834

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

batman-adv: tp_meter: restrict number of unacked list entries

When the unacked_list is unbound, an attacker could send messages with

small lengths and appropriated seqno + gaps to force the receiver to

allocate more and more unacked_list entries. And the end either causing an

out-of-memory situation or increase the management overhead for the (large)

list that significant portions of CPU cycles are wasted in searching

through the list.

When limiting the list to a specific number, it is important to still

correctly add a new entry to the list. But if the list became larger than

the limit, the last entry of the list (with the highest seqno) must be

dropped to still allow the earlier seqnos to finish and therefore to

continue the process. Otherwise, the process might get stuck with too high

seqnos which are not handled by batadv_tp_ack_unordered().

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References