CVE-2026-63836: In the Linux kernel, the following vulnerability has been resolved: batman-adv: tp_meter: avoid divide-by-zero for dec_cwnd The cwnd is always MSS <...

Description

In the Linux kernel, the following vulnerability has been resolved: batman-adv: tp_meter: avoid divide-by-zero for dec_cwnd The cwnd is always MSS <= cwnd <= 0x20000000. But the calculation in batadv_tp_update_cwnd() assumes unsigned 32 bit arithmetics. ((mss * 8) ** 2) / (cwnd * 8) In case cwnd is actually 0x20000000, it will be shifted by 3 bit to the left end up at 0x100000000 or U32_MAX + 1. It will therefore wrap around and be 0 - resulting in: ((mss * 8) ** 2) / 0 This is of course invalid and cannot be calculated. The calculation should must be simplified to avoid this overflow: (mss ** 2) * 8 / cwnd It will keep the precision enhancement from the scaling (by 8) but avoid the overflow in the divisor. In theory, there could still be an overflow in the dividend. It is at the moment fixed to BATADV_TP_PLEN in batadv_tp_recv_ack() - so it is not an imminent problem. But allowing it to use the whole u32 bit range, would mean that it can still use up to 67 bits. To keep this calculation safe for 32 bit arithmetic, mss must never use more than floor((32 - 3) / 2) bits - or in other words: must never be larger than 16383.

Metrics

EPSS Probability

0.17%

7.1th percentile

Probability of exploitation in the next 30 days. Learn more

Affected Software

Source: CNA advisory (CVE.org). NVD analysis pending.

Vendor	Product	Versions
Linux	Linux	>= 33a3bb4a3345bb511f9c69c913da95d4693e2a4e, < 35264c4d46067d6312871488c810cef387f8c1f6; >= 33a3bb4a3345bb511f9c69c913da95d4693e2a4e, < 1381b021bf886b793fa5ffb895a8efae7ba0318f; >= 33a3bb4a3345bb511f9c69c913da95d4693e2a4e, < d08b69da40a101df1e28bfe1e8fa7a09ffa41107; >= 33a3bb4a3345bb511f9c69c913da95d4693e2a4e, < cd74176cf1685f35a2e5f212d15748bbfecb53b6; >= 33a3bb4a3345bb511f9c69c913da95d4693e2a4e, < ac229c86e49fdb96d91f51bc2fa37a9c4f58c44f; >= 33a3bb4a3345bb511f9c69c913da95d4693e2a4e, < 7d2a44bc6bbe39aed03c68864aa0e54e04a50278; >= 33a3bb4a3345bb511f9c69c913da95d4693e2a4e, < 585616dab0aa9c45bc11b2c8082ca78533bc00e9; >= 33a3bb4a3345bb511f9c69c913da95d4693e2a4e, < 33ccd52f3cc9ed46ce395199f89aa3234dc83314
Linux	Linux	4.8

References

Timeline

Published: Jul 19, 2026
Last Modified: Jul 27, 2026
Status: Awaiting Analysis

Frequently Asked Questions

What is CVE-2026-63836?

In the Linux kernel, the following vulnerability has been resolved: batman-adv: tp_meter: avoid divide-by-zero for dec_cwnd The cwnd is always MSS <= cwnd <= 0x20000000. But the calculation in batadv_tp_update_cwnd() assumes unsigned 32 bit arithmetics. ((mss * 8) ** 2) / (cwnd * 8) In case cwnd is actually 0x20000000, it will be shifted by 3 bit to the left end up at 0x100000000 or U32_MAX + 1. It will therefore wrap around and be 0 - resulting in: ((mss * 8) ** 2) / 0 This is of course invalid and cannot be calculated. The calculation should must be simplified to avoid this overflow: (mss ** 2) * 8 / cwnd It will keep the precision enhancement from the scaling (by 8) but avoid the overflow in the divisor. In theory, there could still be an overflow in the dividend. It is at the moment fixed to BATADV_TP_PLEN in batadv_tp_recv_ack() - so it is not an imminent problem. But allowing it to use the whole u32 bit range, would mean that it can still use up to 67 bits. To keep this calculation safe for 32 bit arithmetic, mss must never use more than floor((32 - 3) / 2) bits - or in other words: must never be larger than 16383.

How severe is CVE-2026-63836?

Severity scoring for CVE-2026-63836 is pending analysis. The EPSS model estimates a 0.17% probability of exploitation in the next 30 days.

How do I fix CVE-2026-63836?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2026

View all 2026CVEs →