AZL-74826
See a problem?- Import Source
- https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-74826.json
- JSON Data
- https://api.osv.dev/v1/vulns/AZL-74826
- Upstream
- Published
- 2025-09-19T16:15:42Z
- Modified
- 2026-04-21T04:38:47.745300Z
- Summary
- CVE-2025-39839 affecting package kernel for versions less than 5.15.200.1-1
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
batman-adv: fix OOB read/write in network-coding decode
batadvncskbdecodepacket() trusts codedlen and checks only against skb->len. XOR starts at sizeof(struct batadvunicast_packet), reducing payload headroom, and the source skb length is not verified, allowing an out-of-bounds read and a small out-of-bounds write.
Validate that codedlen fits within the payload area of both destination and source skbuffs before XORing.
- References