VulnSocial

CVE-2026-63834Patch

MEDIUM

Exploitation ongoing with high activity in latest observed window (1 mentions)

Immediate actions

  • Patch affected systems immediately
  • Assume compromise if assets are exposed

Recommended action window: Immediate (within 24h)

NVD description

In the Linux kernel, the following vulnerability has been resolved: batman-adv: tp_meter: restrict number of unacked list entries When the unacked_list is unbound, an attacker could send messages with small lengths and appropriated seqno + gaps to force the receiver to allocate more and more unacked_list entries. And the end either causing an out-of-memory situation or increase the management overhead for the (large) list that significant portions of CPU cycles are wasted in searching through the list. When limiting the list to a specific number, it is important to still correctly add a new entry to the list. But if the list became larger than the limit, the last entry of the list (with the highest seqno) must be dropped to still allow the earlier seqnos to finish and therefore to continue the process. Otherwise, the process might get stuck with too high seqnos which are not handled by batadv_tp_ack_unordered().

Back to dashboard
4.0/ 10 priority

Sources & remediation

Other references

Priority

MEDIUM

Exploitation

ACTIVE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Active exploitation appears in 1 classified signals
  • Patch or workaround signal is available
  • 4 mentions across 4 observed days
  • Momentum state: stable

What's happening

  • Active exploitation reported across 1 signal
  • Patch or workaround mentioned in 2 signals
  • Technical details provided in 2 signals
  • Disclosure: 1 classified signal
  • Peaked 3d ago at 1 mentions (2026-07-19); latest day: 1
  • 4 total mentions across 4 days

Deep dive

Activity timeline4 mentions / 4d
00111Mentions · 2026-07-19: 1Mentions · 2026-09-08: 1Mentions · 2026-09-12: 1Mentions · 2026-09-15: 1Active Exploitation · 2026-09-12: 1Patch / Workaround · 2026-09-08: 1Patch / Workaround · 2026-09-15: 1Technical Details · 2026-07-19: 1Technical Details · 2026-09-15: 107-1909-0809-1209-15
Signal classification3 categories
Patch
250.0%
Disclosure
125.0%
Active Exploitation
125.0%
Referenced assets12 URLs
Classification over time
DateTotalLabels
2026-07-191
Disclosure1
2026-09-081
Patch1
2026-09-121
Active Exploitation1
2026-09-151
Patch1
Full discourse4 posts
  • Mr. OS@ksg93rd
    Active Exploitation

    #Analytics #Threat_Research An analytical review of the main cybersecurity events (Sep 05-12, 2026) 1⃣ Sonicwall SMA1000 Attack https://hunt.io/blog/sonicwall-sma1000-uk-council-attack // CVE-2026-15409 2⃣ Cisco Secure Firewall Management Center Software Authentication Bypass Vulnerability https://hunt.io/blog/sonicwall-sma1000-uk-council-attack 3⃣ Next Nightmare Eclipse Vulnerability https://github.com/MSNightmare/ShieldCrash/blob/main/README.md // Microsoft has failed to properly patch ShieldBreak CVE-2026-69414.. 4⃣ FortiPAM Vulnerability https://amibeingpwned.com/blog/fortinet-pam-vuln // CVE-2026-84388 5⃣ Researchers from Nebula Security have disclosed 18 vulnerabilities in the Linux kernel https://www.openwall.com/lists/oss-security/2026/09/08/1 // CVE-2026-80714, CVE-2026-74597, CVE-2026-74581, CVE-2026-74480, CVE-2026-72255, CVE-2026-72137, CVE-2026-68376, CVE-2026-68162, CVE-2026-64560,  CVE-2026-63834, CVE-2026-52933, CVE-2026-52929, CVE-2026-52924, CVE-2026-52923, CVE-2026-52912, CVE-2026-43501, CVE-2026-43502, CVE-2026-43074, CVE-2026-43042, CVE-2026-31678, CVE-2026-31659, CVE-2026-23274 6⃣ Netscaler ADC Exploit 7⃣ Critical vulnerabilities in MikroTik RouterOS https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/ 8⃣ GRAYRABBIT One-click backdoor // One click. Three critical failures. One backdoor https://www.gendigital.com/blog/insights/research/one-click-backdoor-sogou 9⃣ Attacks using browser-in-browser (BiTB) phishing techniques https://www.huntress.com/blog/phishing-bitb-rmm-attacks 🔟 Beltdown: Escaping the Claude Code sandbox https://www.accomplish.ai/blog/beltdown-escaping-the-claude-code-sandbox/ // An untrusted repository opened in Claude Code can escape the macOS sandbox and run commands on your computer as your privileged user http://www.Geniebot.pro http://www.cyberpocket.org

    Post summary

    The notice lists several recent CVEs, highlighting that MikroTik RouterOS vulnerabilities are currently being exploited in the wild, though it offers no technical details or exploit code.

    01052601
    3.4K followersView on X
  • OS開発者@hacker_infra
    Patch

    https://github.com/NebuSec/CyberMeowfia/tree/main/security-research CVE4つも公開されているがな。エクスプロイト 1 CVE-2026-31659 緩和策 echo "install batman-adv /bin/true" > /etc/modprobe.d/disable-batman-adv.conf 2 cve-2026-74597 緩和策 grubby --update-kernel=ALL --args="ipv6.disable=1" reboot 3 CVE-2026-68376 緩和策 echo "install sctp /bin/true" > /etc/modprobe.d/disable-sctp.conf 4 CVE-2026-63834 echo "install batman-adv /bin/true" > /etc/modprobe.d/disable-batman-adv.conf

    Post summary

    The post enumerates four CVEs and offers mitigation steps, focusing on workarounds rather than exploit details or active attacks.

    00071469
    2.9K followersView on X
  • Threat Landscape@LandscapeThreat
    Patch

    Researchers disclosed CVE-2026-43502, a Linux kernel local privilege-escalation vulnerability in the RDS zerocopy send path, alongside 20 additional exploitable Linux bugs. - An unprivileged local user can obtain root privileges without Linux capabilities or user namespaces when required networking, asynchronous I/O, and RDS components are enabled. - The vulnerability affects kernels from Linux v4.17 and was demonstrated on openSUSE with kernel 6.4.0-150600.23.100. - The issue was fixed by commit 44b550d88b26, first included in Linux v7.1-rc3; public exploits for the listed vulnerabilities are available. VULNERABILITY CVE-2026-23274 CVE-2026-31659 CVE-2026-31678 CVE-2026-43042 CVE-2026-43074 CVE-2026-43501 CVE-2026-43502 CVE-2026-52912 CVE-2026-52923 CVE-2026-52924 CVE-2026-52929 CVE-2026-52933 CVE-2026-63834 CVE-2026-64560 CVE-2026-68162 CVE-2026-68376 CVE-2026-72137 CVE-2026-72255 CVE-2026-74480 CVE-2026-74581 CVE-2026-74597 CVE-2026-80714

    Post summary

    A disclosure of 22 Linux kernel CVEs including CVE-2026-43502 (RDS zerocopy local privilege escalation) with detailed technical information; the vulnerability was patched via commit 44b550d88b26 in Linux v7.1-rc3, and public exploits were noted as available.

    0002055
    123 followersView on X
  • Vulmon Vulnerability Feed@VulmonFeeds
    Disclosure

    CVE-2026-63834 Denial of Service via Unbounded Unacked List in Linux Kernel batman-adv https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-63834

    Post summary

    The post announces CVE-2026-63834, a DoS vulnerability in the Linux kernel batman-adv module caused by an unbounded unacked list, without mentioning exploits, patches, or active use.

    0000086
    4.1K followersView on X

Explore more

Back to dashboard