CVE-2025-39839
batman-adv: fix OOB read/write in network-coding decode
Reported by linux · Published September 19, 2025
In the Linux kernel, the following vulnerability has been resolved: batman-adv: fix OOB read/write in network-coding decode batadv_nc_skb_decode_packet() trusts coded_len and checks only against skb->len. XOR starts at sizeof(struct batadv_unicast_packet), reducing payload headroom, and the source skb length is not verified, allowing an out-of-bounds read and a small out-of-bounds write. Validate that coded_len fits within the payload area of both destination and source sk_buffs before XORing.
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| python3-perf | Amazon Linux | 1:6.1.153-175.280.amzn2023 |
| kernel | Amazon Linux | 1:6.1.153-175.280.amzn2023 |
| kernel-tools-devel | Amazon Linux | 1:6.1.153-175.280.amzn2023 |
| perf | Amazon Linux | 1:6.1.153-175.280.amzn2023 |
| kernel-modules-extra-common | Amazon Linux | 1:6.1.153-175.280.amzn2023 |
| kernel-libbpf | Amazon Linux | 1:6.1.153-175.280.amzn2023 |
| kernel-libbpf-static | Amazon Linux | 1:6.1.153-175.280.amzn2023 |
| kernel-headers | Amazon Linux | 1:6.1.153-175.280.amzn2023 |
| kernel-modules-extra | Amazon Linux | 1:6.1.153-175.280.amzn2023 |
| SCALANCE XRM334 (24 V DC, 8xFO) | Siemens | 3.3 |
| SCALANCE XRH334 (24 V DC, 8xFO, CC) | Siemens | 3.3 |
| SCALANCE XRM334 (230V AC, 2x10G, 24xSFP, 8xSFP+) | Siemens | 3.3 |
10 more packages have a fixed version. See every fix in Lookup.
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| Linux | Linux | 2df5278b0267c799f3e877e8eeddbb6e93cda0bb, 2df5278b0267c799f3e877e8eeddbb6e93cda0bb, 2df5278b0267c799f3e877e8eeddbb6e93cda0bb |
| Linux | Linux | 3.10, 0, 5.4.299 |
| Siemens | SCALANCE XRM334 (24 V DC, 8xFO) | 0 |
| Siemens | SCALANCE XRH334 (24 V DC, 8xFO, CC) | 0 |
| amazon:2023 | python3-perf | 0 |
| Siemens | SCALANCE XRM334 (230V AC, 2x10G, 24xSFP, 8xSFP+) | 0 |
| amazon:2023 | kernel | 0 |
| Siemens | SCALANCE XRM334 (24V DC, 2x10G, 24xSFP, 8xSFP+) | 0 |
| Siemens | SCALANCE XCM324 | 0 |
| Siemens | SCALANCE XRM334 (230 V AC, 12xFO) | 0 |
| amazon:2023 | kernel-tools-devel | 0 |
| Siemens | SCALANCE XRM334 (2x230 V AC, 8xFO) | 0 |
| Siemens | SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family | 0 |
| Siemens | SCALANCE XRM334 (2x230 V AC, 12xFO) | 0 |
| amazon:2023 | perf | 0 |
| amazon:2023 | kernel-modules-extra-common | 0 |
| Siemens | SIMATIC CN 4100 | 0 |
| Siemens | SCALANCE XRM334 (230 V AC, 8xFO) | 0 |
| amazon:2023 | kernel-libbpf | 0 |
| amazon:2023 | kernel-libbpf-static | 0 |
…and 15 more
Timeline
- Sep 19, 2025 CVE Published
- Sep 20, 2025 EPSS Score (30 in total, the first dated here)
- Oct 12, 2025 PoC Published (12 in total, the first dated here)
- Nov 17, 2025 CVE Updated
- Mar 29, 2026 Distribution Patch (113 in total, the first dated here)
- Mar 29, 2026 Security Advisory (124 in total, the first dated here)
- Jun 8, 2026 Coalition ESS Score
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2025-39839
vulnetix vdb fixes CVE-2025-39839Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2025-39839/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart