CVE-2025-39839: Linux Kernel batman-adv OOB read/write in network-coding decode

CVE-2025-39839 · Severity: high · CVSS 8.8 · Published 2025-09-19

A vulnerability was identified in the Linux kernel's batman-adv module, which is used for managing mobile ad-hoc networks. The flaw exists in how the system processes 'network-coding' packets, which are used to optimize wireless traffic. An attacker on the same local network could exploit this to cause a system crash or potentially access sensitive information by sending specially crafted network packets.

Technologies: Linux Kernel, Siemens RUGGEDCOM RST2428P, Siemens SCALANCE XC-300, Siemens SCALANCE XC-400, Siemens SCALANCE XR-300, Siemens SCALANCE XR-500, Siemens SCALANCE XR-500WG. Vendors: Linux, Siemens.

Quick answers

Is CVE-2025-39839 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-39839 being exploited in the wild.
How severe is CVE-2025-39839?
High severity, with a CVSS score of 8.8, published 19 September 2025.
Which products and versions are affected?
Linux Kernel 3.10 to 5.4.299, 5.5 to 5.10.243, 5.11 to 5.15.192, 5.16 to 6.1.151, 6.2 to 6.6.105, 6.7 to 6.12.46, 6.13 to 6.16.6; Linux Kernel All versions prior to the September 2025 patches; Siemens RUGGEDCOM RST2428P < V3.3; Siemens SCALANCE XC-300 < V3.3; and 4 more.
Is there a fix for CVE-2025-39839?
A patch was published on 2025-09-09: Fixes committed to Linux stable trees Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-39839 attacked?
It is attacked from the adjacent network, in an operating system.
Am I affected by CVE-2025-39839?
Check whether you run Linux Kernel, Linux Kernel, Siemens RUGGEDCOM RST2428P or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An out-of-bounds (OOB) read and write vulnerability exists in the batadv_nc_skb_decode_packet() function within the batman-adv kernel module. The root cause is an insufficient validation of the 'coded_len' field provided in network-coding packets; the function trusted this value without verifying it against the actual payload headroom of both the source and destination socket buffers (sk_buffs). An attacker on the adjacent network (Layer 2) can provide a malicious coded_len to trigger OOB memory access during the XOR decoding process. This can result in kernel memory corruption or information leakage. Patches have been released across multiple Linux stable branches (e.g., 6.1, 6.6, 6.10, 6.11) to ensure coded_len fits within the payload area before processing.

Affected products

  • Linux Linux Kernel All versions prior to the September 2025 patches
  • Siemens RUGGEDCOM RST2428P < V3.3
  • Siemens SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family < V3.3

Timeline

  • 2025-08-31: other: Vulnerability reported by Stanislav Fort
  • 2025-09-09: patched: Fixes committed to Linux stable trees
  • 2025-09-19: disclosed: CVE-2025-39839 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.