CVE-2025-39839

batman-adv: fix OOB read/write in network-coding decode

State: Published
Severity: 8.8 High
Published: Sep 19, 2025
Updated: Aug 5, 2026
Reserved: Apr 16, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

batman-adv: fix OOB read/write in network-coding decode

batadv_nc_skb_decode_packet() trusts coded_len and checks only against skb->len. XOR starts at sizeof(struct batadv_unicast_packet), reducing payload headroom, and the source skb length is not verified, allowing an out-of-bounds read and a small out-of-bounds write.

Validate that coded_len fits within the payload area of both destination and source sk_buffs before XORing.

Scores

CVSS	Score	Vector	Source
3.1	8.8 High	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	2df5278b0267c799f3e877e8eeddbb6e93cda0bb to before 30fc47248f02b8a14a61df469e1da4704be1a19fAffected 2df5278b0267c799f3e877e8eeddbb6e93cda0bb to before 1e36c6c8dc8023b4bbe9a16e819f9998b9b6a183Affected 2df5278b0267c799f3e877e8eeddbb6e93cda0bb to before 5d334bce9fad58cf328d8fa14ea1fff855819863Affected 2df5278b0267c799f3e877e8eeddbb6e93cda0bb to before dce6c2aa70e94c04c523b375dfcc664d7a0a560aAffected 2df5278b0267c799f3e877e8eeddbb6e93cda0bb to before bb37252c9af1cb250f34735ee98f80b46be3cef1Affected 2df5278b0267c799f3e877e8eeddbb6e93cda0bb to before 20080709457bc1e920eb002483d7d981d9b2ac1cAffected 2df5278b0267c799f3e877e8eeddbb6e93cda0bb to before a67c6397fcb7e842d3c595243049940970541c48Affected 2df5278b0267c799f3e877e8eeddbb6e93cda0bb to before d77b6ff0ce35a6d0b0b7b9581bc3f76d041d4087Affected
LinuxLinux	3.10Affected before 3.10Not affected 5.4.299 through 5.4.Not affected 5.10.243 through 5.10.Not affected 5.15.192 through 5.15.Not affected 6.1.151 through 6.1.Not affected 6.6.105 through 6.6.Not affected 6.12.46 through 6.12.Not affected 6.16.6 through 6.16.*Not affected 6.17 and laterNot affected

Product

Versions

LinuxLinux

2df5278b0267c799f3e877e8eeddbb6e93cda0bb to before 30fc47248f02b8a14a61df469e1da4704be1a19fAffected
2df5278b0267c799f3e877e8eeddbb6e93cda0bb to before 1e36c6c8dc8023b4bbe9a16e819f9998b9b6a183Affected
2df5278b0267c799f3e877e8eeddbb6e93cda0bb to before 5d334bce9fad58cf328d8fa14ea1fff855819863Affected
2df5278b0267c799f3e877e8eeddbb6e93cda0bb to before dce6c2aa70e94c04c523b375dfcc664d7a0a560aAffected
2df5278b0267c799f3e877e8eeddbb6e93cda0bb to before bb37252c9af1cb250f34735ee98f80b46be3cef1Affected
2df5278b0267c799f3e877e8eeddbb6e93cda0bb to before 20080709457bc1e920eb002483d7d981d9b2ac1cAffected
2df5278b0267c799f3e877e8eeddbb6e93cda0bb to before a67c6397fcb7e842d3c595243049940970541c48Affected
2df5278b0267c799f3e877e8eeddbb6e93cda0bb to before d77b6ff0ce35a6d0b0b7b9581bc3f76d041d4087Affected

LinuxLinux

3.10Affected
before 3.10Not affected
5.4.299 through 5.4.*Not affected
5.10.243 through 5.10.*Not affected
5.15.192 through 5.15.*Not affected
6.1.151 through 6.1.*Not affected
6.6.105 through 6.6.*Not affected
6.12.46 through 6.12.*Not affected
6.16.6 through 6.16.*Not affected
6.17 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.