In the Linux kernel, the following vulnerability has been resolved:
batman-adv: fix OOB read/write in network-coding decode
batadvncskbdecodepacket() trusts codedlen and checks only against skb->len. XOR starts at sizeof(struct batadvunicast_packet), reducing payload headroom, and the source skb length is not verified, allowing an out-of-bounds read and a small out-of-bounds write.
Validate that codedlen fits within the payload area of both destination and source skbuffs before XORing.
[
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"269443426897945046423265831531079286321",
"99770769199870055054346831270504915760",
"335325700844274096922120378636897701793",
"115699279083138027699175734968646368278"
]
},
"id": "CVE-2025-39839-02c08b3a",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5d334bce9fad58cf328d8fa14ea1fff855819863",
"signature_version": "v1",
"target": {
"file": "net/batman-adv/network-coding.c"
},
"deprecated": false
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"269443426897945046423265831531079286321",
"99770769199870055054346831270504915760",
"335325700844274096922120378636897701793",
"115699279083138027699175734968646368278"
]
},
"id": "CVE-2025-39839-16c047da",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bb37252c9af1cb250f34735ee98f80b46be3cef1",
"signature_version": "v1",
"target": {
"file": "net/batman-adv/network-coding.c"
},
"deprecated": false
},
{
"digest": {
"function_hash": "210848853324155998513207903639478351628",
"length": 1361.0
},
"id": "CVE-2025-39839-2110caba",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a67c6397fcb7e842d3c595243049940970541c48",
"signature_version": "v1",
"target": {
"file": "net/batman-adv/network-coding.c",
"function": "batadv_nc_skb_decode_packet"
},
"deprecated": false
},
{
"digest": {
"function_hash": "210848853324155998513207903639478351628",
"length": 1361.0
},
"id": "CVE-2025-39839-4785146c",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5d334bce9fad58cf328d8fa14ea1fff855819863",
"signature_version": "v1",
"target": {
"file": "net/batman-adv/network-coding.c",
"function": "batadv_nc_skb_decode_packet"
},
"deprecated": false
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"269443426897945046423265831531079286321",
"99770769199870055054346831270504915760",
"335325700844274096922120378636897701793",
"115699279083138027699175734968646368278"
]
},
"id": "CVE-2025-39839-4bd99e42",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@20080709457bc1e920eb002483d7d981d9b2ac1c",
"signature_version": "v1",
"target": {
"file": "net/batman-adv/network-coding.c"
},
"deprecated": false
},
{
"digest": {
"function_hash": "210848853324155998513207903639478351628",
"length": 1361.0
},
"id": "CVE-2025-39839-5a043def",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@20080709457bc1e920eb002483d7d981d9b2ac1c",
"signature_version": "v1",
"target": {
"file": "net/batman-adv/network-coding.c",
"function": "batadv_nc_skb_decode_packet"
},
"deprecated": false
},
{
"digest": {
"function_hash": "210848853324155998513207903639478351628",
"length": 1361.0
},
"id": "CVE-2025-39839-8c047c84",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bb37252c9af1cb250f34735ee98f80b46be3cef1",
"signature_version": "v1",
"target": {
"file": "net/batman-adv/network-coding.c",
"function": "batadv_nc_skb_decode_packet"
},
"deprecated": false
},
{
"digest": {
"function_hash": "210848853324155998513207903639478351628",
"length": 1361.0
},
"id": "CVE-2025-39839-8fdc983a",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@30fc47248f02b8a14a61df469e1da4704be1a19f",
"signature_version": "v1",
"target": {
"file": "net/batman-adv/network-coding.c",
"function": "batadv_nc_skb_decode_packet"
},
"deprecated": false
},
{
"digest": {
"function_hash": "210848853324155998513207903639478351628",
"length": 1361.0
},
"id": "CVE-2025-39839-9762c6b6",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1e36c6c8dc8023b4bbe9a16e819f9998b9b6a183",
"signature_version": "v1",
"target": {
"file": "net/batman-adv/network-coding.c",
"function": "batadv_nc_skb_decode_packet"
},
"deprecated": false
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"269443426897945046423265831531079286321",
"99770769199870055054346831270504915760",
"335325700844274096922120378636897701793",
"115699279083138027699175734968646368278"
]
},
"id": "CVE-2025-39839-ad629c43",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1e36c6c8dc8023b4bbe9a16e819f9998b9b6a183",
"signature_version": "v1",
"target": {
"file": "net/batman-adv/network-coding.c"
},
"deprecated": false
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"269443426897945046423265831531079286321",
"99770769199870055054346831270504915760",
"335325700844274096922120378636897701793",
"115699279083138027699175734968646368278"
]
},
"id": "CVE-2025-39839-b6410c95",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dce6c2aa70e94c04c523b375dfcc664d7a0a560a",
"signature_version": "v1",
"target": {
"file": "net/batman-adv/network-coding.c"
},
"deprecated": false
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"269443426897945046423265831531079286321",
"99770769199870055054346831270504915760",
"335325700844274096922120378636897701793",
"115699279083138027699175734968646368278"
]
},
"id": "CVE-2025-39839-d50cd4e9",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@30fc47248f02b8a14a61df469e1da4704be1a19f",
"signature_version": "v1",
"target": {
"file": "net/batman-adv/network-coding.c"
},
"deprecated": false
},
{
"digest": {
"function_hash": "210848853324155998513207903639478351628",
"length": 1361.0
},
"id": "CVE-2025-39839-db0ca947",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dce6c2aa70e94c04c523b375dfcc664d7a0a560a",
"signature_version": "v1",
"target": {
"file": "net/batman-adv/network-coding.c",
"function": "batadv_nc_skb_decode_packet"
},
"deprecated": false
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"269443426897945046423265831531079286321",
"99770769199870055054346831270504915760",
"335325700844274096922120378636897701793",
"115699279083138027699175734968646368278"
]
},
"id": "CVE-2025-39839-fbbb8d38",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a67c6397fcb7e842d3c595243049940970541c48",
"signature_version": "v1",
"target": {
"file": "net/batman-adv/network-coding.c"
},
"deprecated": false
}
]