High 8.8Published Sep 19, 2025

CVE-2025-39839batman-adv: fix OOB read/write in network-coding decode

Updated under an hour ago (Oct 27, 2026, 11:00 AM ET)

Does this affect you?

It affects Linux and 19 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: batman-adv: fix OOB read/write in network-coding decode batadv_nc_skb_decode_packet() trusts coded_len and checks only against skb->len. XOR starts at sizeof(struct batadv_unicast_packet), reducing payload headroom, and the source skb length is not verified, allowing an out-of-bounds read and a small out-of-bounds write. Validate that coded_len fits within the payload area of both destination and source sk_buffs before XORing.

CVSS: 8.8 HIGH (v3.1, CNA)CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Aug 5, 2026
First seen by InfoSec Signals: Oct 19, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 2df5278b0267c799f3e877e8eeddbb6e93cda0bb before 30fc47248f02b8a14a61df469e1da4704be1a19f; 2df5278b0267c799f3e877e8eeddbb6e93cda0bb builds before 1e36c6c8dc8023b4bbe9a16e819f9998b9b6a183; from 2df5278b0267c799f3e877e8eeddbb6e93cda0bb before 5d334bce9fad58cf328d8fa14ea1fff855819863; from 2df5278b0267c799f3e877e8eeddbb6e93cda0bb before dce6c2aa70e94c04c523b375dfcc664d7a0a560a; from 2df5278b0267c799f3e877e8eeddbb6e93cda0bb before bb37252c9af1cb250f34735ee98f80b46be3cef1; from 2df5278b0267c799f3e877e8eeddbb6e93cda0bb before 20080709457bc1e920eb002483d7d981d9b2ac1c; from 2df5278b0267c799f3e877e8eeddbb6e93cda0bb before a67c6397fcb7e842d3c595243049940970541c48; from 2df5278b0267c799f3e877e8eeddbb6e93cda0bb before d77b6ff0ce35a6d0b0b7b9581bc3f76d041d4087	CNA record
Siemens RUGGEDCOM RST2428P siemens:ruggedcom_rst2428p (from the name)	before V3.3	CISA ADP
Siemens SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family siemens:scalance_xc_300_xr_300_xc_400_xr_500wg_xr_500_family (from the name)	before V3.3	CISA ADP
Siemens SCALANCE XCH328 siemens:scalance_xch328 (from the name)	before V3.3	CISA ADP
Siemens SCALANCE XCM324 siemens:scalance_xcm324 (from the name)	before V3.3	CISA ADP
Siemens SCALANCE XCM328 siemens:scalance_xcm328 (from the name)	before V3.3	CISA ADP
Siemens SCALANCE XCM332 siemens:scalance_xcm332 (from the name)	before V3.3	CISA ADP
Siemens SCALANCE XRH334 (24 V DC, 8xFO, CC) siemens:scalance_xrh334_24_v_dc_8xfo_cc (from the name)	before V3.3	CISA ADP
Siemens SCALANCE XRM334 (230 V AC, 12xFO) siemens:scalance_xrm334_230_v_ac_12xfo (from the name)	before V3.3	CISA ADP
Siemens SCALANCE XRM334 (230 V AC, 8xFO) siemens:scalance_xrm334_230_v_ac_8xfo (from the name)	before V3.3	CISA ADP
1–10 of 20

References

References

https://git.kernel.org/stable/c/30fc47248f02b8a14a61df469e1da4704be1a19f	patch
https://git.kernel.org/stable/c/1e36c6c8dc8023b4bbe9a16e819f9998b9b6a183	patch
https://git.kernel.org/stable/c/5d334bce9fad58cf328d8fa14ea1fff855819863	patch
https://git.kernel.org/stable/c/dce6c2aa70e94c04c523b375dfcc664d7a0a560a	patch
https://git.kernel.org/stable/c/bb37252c9af1cb250f34735ee98f80b46be3cef1	patch
https://git.kernel.org/stable/c/20080709457bc1e920eb002483d7d981d9b2ac1c	patch
https://git.kernel.org/stable/c/a67c6397fcb7e842d3c595243049940970541c48	patch
https://git.kernel.org/stable/c/d77b6ff0ce35a6d0b0b7b9581bc3f76d041d4087	patch
https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html	mailing-list, third-party-advisory
https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html	mailing-list, third-party-advisory
1–10 of 12

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.