CVE-2026-63836

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

batman-adv: tp_meter: avoid divide-by-zero for dec_cwnd

The cwnd is always MSS <= cwnd <= 0x20000000. But the calculation in

batadv_tp_update_cwnd() assumes unsigned 32 bit arithmetics.

((mss * 8) ** 2) / (cwnd * 8)

In case cwnd is actually 0x20000000, it will be shifted by 3 bit to the

left end up at 0x100000000 or U32_MAX + 1. It will therefore wrap around

and be 0 - resulting in:

((mss * 8) ** 2) / 0

This is of course invalid and cannot be calculated. The calculation should

must be simplified to avoid this overflow:

(mss ** 2) * 8 / cwnd

It will keep the precision enhancement from the scaling (by 8) but avoid

the overflow in the divisor.

In theory, there could still be an overflow in the dividend. It is at the

moment fixed to BATADV_TP_PLEN in batadv_tp_recv_ack() - so it is not an

imminent problem. But allowing it to use the whole u32 bit range, would

mean that it can still use up to 67 bits. To

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References