CVE-2026-72226

In the Linux kernel, the following vulnerability has been resolved:

batman-adv: tt: prevent TVLV OOB check overflow

A TT unicast TVLV contains the number of VLANs stored in it. This number is

an u16 and gets multiplied by the size of the struct

batadv_tvlv_tt_vlan_data (8 bytes). The size can therefore overflow the u16

used to store the tt_vlan_len. All additional safety checks to prevent

out-of-bounds access of the TVLV buffer are invalid due to this overflow.

Using size_t prevents this overflow and ensures that the safety checks

compare against the actual buffer requirements.