CVE-2026-89949

Not scored yetLast modified Oct 19, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

batman-adv: dat: avoid unaligned fault in IP extraction

Independent of the alignment of the ARP packet in the SKB, either the batadv_arp_ip_src or the batadv_arp_ip_dst will have an unaligned access (on HW without native unaligned read support).

Use get_unaligned() to handle this properly on all architectures.

Metrics

No CVSS score has been published yet.

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
LinuxLinux>= 5c3a0e5535933349a5d6e6bc8b704e0611f21d3f, < b1bbc694ca51adb8dbed3f3235b4fcbdb44e0e20; >= 5c3a0e5535933349a5d6e6bc8b704e0611f21d3f, < 15dbfb37f0e1a085d48deeb8f5238e9d28127dde; >= 5c3a0e5535933349a5d6e6bc8b704e0611f21d3f, < a170d4617e8cca05a1314de61728a262ef272782; >= 5c3a0e5535933349a5d6e6bc8b704e0611f21d3f, < c74a4acf41d19f21199dec2d6c813c90d31cd02c; >= 5c3a0e5535933349a5d6e6bc8b704e0611f21d3f, < 91c99b4e152023c7d458a5dedd52d2b0d7df4ce3; >= 5c3a0e5535933349a5d6e6bc8b704e0611f21d3f, < 1cfa7d5f70d54cb8c7e82df739430782d1996ee1; >= 5c3a0e5535933349a5d6e6bc8b704e0611f21d3f, < 0c2df865338bbf92aa45b9253e5f9b8ef2d9992f; >= 5c3a0e5535933349a5d6e6bc8b704e0611f21d3f, < 0121afa52cdb88cfb4d5d7bd126a23a9100121d8
LinuxLinux3.8

References

Timeline

Published
Sep 16, 2026
Last modified
Oct 19, 2026
NVD status
Received

Related CVEs from 2026

CVE-2026-89954.3The Poll Maker – Versus Polls, Anonymous Polls, Image Polls plugin for WordPress is vulnerable to Sensitive Information Exposure in versionsCVE-2026-89950In the Linux kernel, the following vulnerability has been resolved: batman-adv: mcast: linearize skbuff for packet generation batadv_mcastCVE-2026-899518.8In the Linux kernel, the following vulnerability has been resolved: batman-adv: fix stale receive device on merged fragments Fragment reasCVE-2026-89952In the Linux kernel, the following vulnerability has been resolved: mtd: rawnand: validate ONFI extended parameter page sections nand_flasCVE-2026-89953In the Linux kernel, the following vulnerability has been resolved: mtd: mtdoops: free page bitmap when the backing MTD is removed mtdoopsCVE-2026-899548.0In the Linux kernel, the following vulnerability has been resolved: mtd: afs: validate v2 image info bounds The AFS v2 parser uses footer[CVE-2026-89955In the Linux kernel, the following vulnerability has been resolved: s390/vfio-ap: Fix NULL deref in status_show() during queue probe When CVE-2026-89956In the Linux kernel, the following vulnerability has been resolved: s390/vfio-ap: Fix missing lock required to access list of ap_matrix_mdeCVE-2026-899578.8In the Linux kernel, the following vulnerability has been resolved: s390/vfio-ap: Fix hot-unplug skipped when last AP adapter or domain remCVE-2026-89958In the Linux kernel, the following vulnerability has been resolved: s390/vfio-ap: Fix dereference matrix_mdev->kvm without checking for NULCVE-2026-899598.8In the Linux kernel, the following vulnerability has been resolved: s390/vfio-ap: Fix control domain removal in vfio_ap_mdev_cfg_remove ThCVE-2026-89966.5The Backup and Staging by WP Time Capsule plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and in
CVE-2026-89949: Unscored | Vulnix