Junglewise Threat Intelligence

CVE-2025-39839: Linux Kernel batman-adv OOB read/write in network-coding decode

CVE-2025-39839 · Severity: high · CVSS 8.8 · Published 2025-09-19

Technologies: Siemens SCALANCE XR-500, Siemens RUGGEDCOM RST2428P, Siemens SCALANCE XC-300, Linux Kernel, Siemens SCALANCE XR-500WG, Siemens SCALANCE XR-300, Siemens SCALANCE XC-400. Vendors: Siemens, Linux.

Executive brief

A vulnerability was identified in the Linux kernel's batman-adv module, which is used for managing mobile ad-hoc networks. The flaw exists in how the system processes 'network-coding' packets, which are used to optimize wireless traffic. An attacker on the same local network could exploit this to cause a system crash or potentially access sensitive information by sending specially crafted network packets.

Technical details

An out-of-bounds (OOB) read and write vulnerability exists in the batadv_nc_skb_decode_packet() function within the batman-adv kernel module. The root cause is an insufficient validation of the 'coded_len' field provided in network-coding packets; the function trusted this value without verifying it against the actual payload headroom of both the source and destination socket buffers (sk_buffs). An attacker on the adjacent network (Layer 2) can provide a malicious coded_len to trigger OOB memory access during the XOR decoding process. This can result in kernel memory corruption or information leakage. Patches have been released across multiple Linux stable branches (e.g., 6.1, 6.6, 6.10, 6.11) to ensure coded_len fits within the payload area before processing.

Affected products

  • Linux Linux Kernel All versions prior to the September 2025 patches
  • Siemens RUGGEDCOM RST2428P < V3.3
  • Siemens SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family < V3.3

Timeline

  • 2025-08-31: other: Vulnerability reported by Stanislav Fort
  • 2025-09-09: patched: Fixes committed to Linux stable trees
  • 2025-09-19: disclosed: CVE-2025-39839 published

References

Related threats