Loading story…
Researchers extended Syzkaller with a Syzlang grammar for crafted Ethernet frames to fuzz previously uncovered packet-reception paths in Linux’s batman-adv mesh-networking subsystem, particularly code in routing.c that had received no Syzbot coverage. The approach follows established work on exposing kernel networking interfaces to external-input fuzzing and targets protocol parsers reachable through network traffic rather than only local syscall surfaces.
The campaign identified three defects: a 16-bit integer overflow in OGM fragmentation, a use-after-free race in the throughput-meter path during interface deletion, and a TT TVLV VLAN-length truncation that can produce an out-of-bounds read. The researchers’ overflow fix has been merged into Linux mainline, while patches for the use-after-free were already circulating on kernel mailing lists; organizations using batman-adv should track kernel updates and prioritize remediation as fixes become available.
See affected versions and whether adversaries are exploiting it.
4 events from the most recent confirmed update back to the earliest known activity.
Researchers identified an issue in batadv_tt_tvlv_unicast_handler_v1 where a VLAN-data size can be truncated when assigned to the 16-bit tt_vlan_len variable. The underestimated length can lead to an out-of-bounds read.
The fuzzing work identified a slab use-after-free race in which a batman-adv throughput-meter kernel thread can access mesh-interface data after its interface is deleted. The issue was already known and patches had been posted to Linux kernel mailing lists.
Researchers identified a signed 16-bit buff_pos overflow in batadv_iv_ogm_send_to_if that could bypass packet-length validation during OGM fragmentation. They submitted a fix widening the variable to signed 32-bit, and it was merged into Linux mainline.
Researchers found that the batman-adv routing.c path had no Syzbot coverage, then modified Syzkaller and added Syzlang Ethernet-frame packet definitions to exercise batman-adv reception logic.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Linux kernel fuzzing tools are continuing to surface hard-to-find defects in core subsystems, with coverage-guided testing and automated crash reporting helping developers trace bugs across memory management, concurrency, and system call interactions. The reporting highlights the `syzkaller` ecosystem—`syz-manager`, `syz-executor`, and `syzbot`—alongside kernel instrumentation such as `KCOV`, **KASAN**, and **KCSAN**, which are used to expand code coverage and detect memory-safety and race-condition issues during testing. One cited case involved a `syzbot`-tracked socket memory accounting warning, identified as `de6565462ab540f50e47`, that was traced to a signedness flaw in TCP socket buffer remaining-space calculations. The bug corrupted internal accounting and was fixed upstream in Linux kernel commit `d3a5f2871adc`, titled **"tcp: Correct signedness in skb remaining space calculation"**. The reporting also notes that `syzbot` crash reports do not automatically indicate exploitable vulnerabilities, because some crashes require privileged conditions or have limited security impact.
Aug 3, 2026
Google’s syzkaller project documents an external USB fuzzing framework that exercises Linux kernel USB drivers in local or virtualized environments without physical USB-emulation hardware or QEMU `usbredir`. The framework uses Raw Gadget with Dummy HCD/UDC controllers, KCOV coverage collection, and USB pseudo-syscalls to emulate enumeration, control requests, and endpoint traffic; an upstream USB-focused syzbot manager is also tracking fuzzing results. The capability targets a subsystem with a record of memory-safety flaws reachable by malicious USB devices. Earlier syzkaller research identified 15 Linux USB vulnerabilities, including NULL-pointer dereferences, use-after-free bugs, and a double-free; 13 had upstream fixes while `CVE-2019-15290` and `CVE-2019-15291` were still unpatched at the time of disclosure. Organizations should prioritize supported kernel updates and restrict untrusted USB peripherals, while noting that the current fuzzing implementation does not support USB 3 or isochronous transfers.
Aug 28, 2026
A flaw in the Linux kernel's BPF disassembler was reported after **syzbot** and **UBSAN** identified an out-of-bounds array access in `print_bpf_insn()`, the function used to format BPF instructions for verifier diagnostics. The bug is triggered when a malformed signed-load instruction using `BPF_MEMSX | BPF_DW` reaches diagnostic disassembly code before opcode validation fully rejects it, causing the kernel to index past the end of the three-entry `bpf_ldsx_string[]` table. No evidence has been presented that the issue enables privilege escalation, information disclosure, remote exploitation, or abuse by unprivileged users. A two-patch fix was proposed and then applied to `bpf/bpf.git`, changing the disassembler to reject invalid signed double-word load encodings and fall back to the existing `BUG_ldx` diagnostic path instead of performing the unsafe table lookup. The patch series, authored by Kumar Kartikeya Dwivedi, reviewed by Jiayuan Chen, and merged by Daniel Borkmann, also adds a self-test to catch regressions. The issue appears to exist in current kernel source, but affected released versions and downstream distributions have not yet been identified.
Aug 21, 2026