CVE-2025-39839

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-39839
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-39839.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-39839
Downstream
Related
Published
2025-09-19T15:26:14.688Z
Modified
2026-03-23T05:03:06.238091761Z
Summary
batman-adv: fix OOB read/write in network-coding decode
Details

In the Linux kernel, the following vulnerability has been resolved:

batman-adv: fix OOB read/write in network-coding decode

batadvncskbdecodepacket() trusts codedlen and checks only against skb->len. XOR starts at sizeof(struct batadvunicast_packet), reducing payload headroom, and the source skb length is not verified, allowing an out-of-bounds read and a small out-of-bounds write.

Validate that codedlen fits within the payload area of both destination and source skbuffs before XORing.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/39xxx/CVE-2025-39839.json",
    "cna_assigner": "Linux"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
2df5278b0267c799f3e877e8eeddbb6e93cda0bb
Fixed
30fc47248f02b8a14a61df469e1da4704be1a19f
Fixed
1e36c6c8dc8023b4bbe9a16e819f9998b9b6a183
Fixed
5d334bce9fad58cf328d8fa14ea1fff855819863
Fixed
dce6c2aa70e94c04c523b375dfcc664d7a0a560a
Fixed
bb37252c9af1cb250f34735ee98f80b46be3cef1
Fixed
20080709457bc1e920eb002483d7d981d9b2ac1c
Fixed
a67c6397fcb7e842d3c595243049940970541c48
Fixed
d77b6ff0ce35a6d0b0b7b9581bc3f76d041d4087

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-39839.json"