CVE-2026-31659

In the Linux kernel, the following vulnerability has been resolved:  batman-adv: reject oversized global TT response buffers  batadvttpreparetvlvglobaldata() builds the allocation length for a global TT response in 16-bit temporaries. When a remote originator advertises a large enough global TT, the TT payload length plus the VLAN header offset can exceed 65535 and wrap before kmalloc().  The full-table response path still uses the original TT payload length when it fills ttchange, so the wrapped allocation is too small and batadvttpreparetvlvglobal_data() writes past the end of the heap object before the later packet-size check runs.  Fix this by rejecting TT responses whose TVLV value length cannot fit in the 16-bit TVLV payload length field.