CVE-2025-39839: batman-adv: fix OOB read/write in network-coding decode

High severity · published Sep 19, 2025

CVE-2025-39839

batman-adv: fix OOB read/write in network-coding decode

7.1

CVSS

0.3%

EPSS

On KEV

Description

In the Linux kernel, the following vulnerability has been resolved: batman-adv: fix OOB read/write in network-coding decode batadv_nc_skb_decode_packet() trusts coded_len and checks only against skb->len. XOR starts at sizeof(struct batadv_unicast_packet), reducing payload headroom, and the source skb length is not verified, allowing an out-of-bounds read and a small out-of-bounds write. Validate that coded_len fits within the payload area of both destination and source sk_buffs before XORing.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Attack vector

Local

Complexity

Low

Privileges

Low

User interaction

None

Confidentiality

High

Integrity

None

Availability

High

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)0.3% · higher than 18% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

Kernel · Linux

3.10 before 5.4.299; 5.5 before 5.10.243; 5.11 before 5.15.192; 5.16 before 6.1.151; 6.2 before 6.6.105; 6.7 before 6.12.46; +5 more · source: NVD

Linux · Linux

2df5278b0267c799f3e877e8eeddbb6e93cda0bb before 30fc47248f02b8a14a61df469e1da4704be1a19f; 2df5278b0267c799f3e877e8eeddbb6e93cda0bb before 1e36c6c8dc8023b4bbe9a16e819f9998b9b6a183; 2df5278b0267c799f3e877e8eeddbb6e93cda0bb before 5d334bce9fad58cf328d8fa14ea1fff855819863; 2df5278b0267c799f3e877e8eeddbb6e93cda0bb before dce6c2aa70e94c04c523b375dfcc664d7a0a560a; 2df5278b0267c799f3e877e8eeddbb6e93cda0bb before bb37252c9af1cb250f34735ee98f80b46be3cef1; 2df5278b0267c799f3e877e8eeddbb6e93cda0bb before 20080709457bc1e920eb002483d7d981d9b2ac1c; +3 more · source: vendor

Debian Linux · Debian

11.0 · source: NVD

RUGGEDCOM RST2428P · Siemens

before V3.3 · source: CISA

SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family · Siemens

before V3.3 · source: CISA

SCALANCE XCH328 · Siemens

before V3.3 · source: CISA

SCALANCE XCM324 · Siemens

before V3.3 · source: CISA

SCALANCE XCM328 · Siemens

before V3.3 · source: CISA

SCALANCE XCM332 · Siemens

before V3.3 · source: CISA

SCALANCE XRH334 (24 V DC, 8xFO, CC) · Siemens

before V3.3 · source: CISA

SCALANCE XRM334 (230 V AC, 12xFO) · Siemens

before V3.3 · source: CISA

SCALANCE XRM334 (230 V AC, 8xFO) · Siemens

before V3.3 · source: CISA

In the news

VulnerabilityHigh

Siemens SINEC OS

View CSAF Summary SINEC OS before V3.3 contains third-party components with multiple vulnerabilities. Siemens has released new versions for the affected products and recommends to update to the latest versions. The following versions of Siemens SINEC OS are affected: RUGGEDCOM RST2428P (6GK6242-6PA00) vers:intdot/<3.3 (CVE-2022-48174, CVE-2023-7256, CVE-2023-39810, CVE-2023-42363, CVE-2023-42364, CVE-2023-42365, CVE-2023-42366, CVE-2024-6197, CVE-2024-6874, CVE-2024-7264, CVE-2024-8006, CVE-2024-8096, CVE-2024-9681, CVE-2024-11053, CVE-2024-12718, CVE-2024-41996, CVE-2024-47619, CVE-2024-52533, CVE-2025-0167, CVE-2025-0665, CVE-2025-0725, CVE-2025-1390, CVE-2025-3360, CVE-2025-4138, CVE-2025-4330, CVE-2025-4373, CVE-2025-4435, CVE-2025-4516, CVE-2025-4517, CVE-2025-6141, CVE-2025-9086, CVE-2025-9230, CVE-2025-9231, CVE-2025-9232, CVE-2025-10148, CVE-2025-27587, CVE-2025-32433, CVE-2025-38084, CVE-2025-38085, CVE-2025-38086, CVE-2025-38345, CVE-2025-38350, CVE-2025-38498, CVE-2025-39839, CVE-2025-39841, CVE-2025-39846, CVE-2025-39853, CVE-2025-39860, CVE-2025-39864, CVE-2025-39865, CVE-2025-59375) SCALANCE XCH328 (6GK5328-4TS01-2EC2) vers:intdot/<3.3 (CVE-2022-48174, CVE-2023-7256, CVE-2023-39810, CVE-2023-42363, CVE-2023-42364, CVE-2023-42365, CVE-2023-42366, CVE-2024-6197, CVE-2024-6874, CVE-2024-7264, CVE-2024-8006, CVE-2024-8096, CVE-2024-9681, CVE-2024-11053, CVE-2024-12718, CVE-2024-41996, CVE-2024-47619, CVE-2024-52533, CVE-2025-0167, CVE-2025-0665...

CVE-2022-48174 CVE-2023-7256 CVE-2023-39810

Feb 12, 2026·CISA Advisories

Affected product

Kernel

Linux

All Kernel CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2025-39839

CVE.org

https://www.cve.org/CVERecord?id=CVE-2025-39839

Patch