{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2025-39839", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T07:20:57.141Z", "datePublished": "2025-09-19T15:26:14.688Z", "dateUpdated": "2026-08-05T12:05:32.570Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:05:32.570Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbatman-adv: fix OOB read/write in network-coding decode\n\nbatadv_nc_skb_decode_packet() trusts coded_len and checks only against\nskb->len. XOR starts at sizeof(struct batadv_unicast_packet), reducing\npayload headroom, and the source skb length is not verified, allowing an\nout-of-bounds read and a small out-of-bounds write.\n\nValidate that coded_len fits within the payload area of both destination\nand source sk_buffs before XORing." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:A - Coded packets arrive as raw ETH_P_BATMAN layer-2 frames from a direct mesh neighbor over Ethernet or WiFi, handled by batadv_batman_skb_recv() with no IP routing involved. This is the classic same-broadcast-domain / WiFi-mesh injection scenario, i.e. Adjacent.\nAC:L - The attacker controls both halves of the primitive — the small buffered source frame (routed through the victim so send.c clones it into the decoding hash) and the oversized coded packet carrying coded_len, the MAC-based path key and the CRC packet_id, all computable offline. No race, no memory-layout guessing, and NC-capable nodes self-advertise via the BATADV_TVLV_NC OGM container, so the trigger is deterministic and repeatable.\nPR:N - batman-adv performs no authentication, encryption, or authorization on received frames; any node able to emit frames on the mesh segment reaches batadv_nc_recv_coded_packet(). No credentials, capabilities, or prior mesh membership approval are required.\nUI:N - The victim node processes the injected coded packet automatically in softirq receive context. No action by any user or administrator is needed beyond the mesh already running.\nS:U - The out-of-bounds read and write corrupt kernel heap memory within the kernel's own security authority. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - The missing nc_packet->skb->len check allows reading roughly 1.4 KB of kernel heap past the buffered source skb, and because the data is XORed against attacker-known plaintext and then forwarded to an attacker-chosen orig_dest, the raw heap bytes are recovered remotely. This is a directly weaponizable kernel memory disclosure, not a bounded leak.\nI:H - The XOR overruns the destination skb by up to h_size (10) bytes with attacker-influenced content, landing in skb_shared_info (nr_frags, frag_list, dataref, gso fields) when tailroom is zero. Corrupting those fields drives bogus frag iteration and page puts in skb_release_data(), giving a heap-corruption/UAF primitive exploitable for control-flow hijack.\nA:H - The ~1.4 KB out-of-bounds read readily walks off the slab into unmapped memory, and the skb_shared_info overwrite corrupts refcounts and frag pointers, producing KASAN splats, oopses, or panics. The attacker can repeat this at will with no authentication." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "net/batman-adv/network-coding.c" ], "versions": [ { "version": "2df5278b0267c799f3e877e8eeddbb6e93cda0bb", "lessThan": "30fc47248f02b8a14a61df469e1da4704be1a19f", "status": "affected", "versionType": "git" }, { "version": "2df5278b0267c799f3e877e8eeddbb6e93cda0bb", "lessThan": "1e36c6c8dc8023b4bbe9a16e819f9998b9b6a183", "status": "affected", "versionType": "git" }, { "version": "2df5278b0267c799f3e877e8eeddbb6e93cda0bb", "lessThan": "5d334bce9fad58cf328d8fa14ea1fff855819863", "status": "affected", "versionType": "git" }, { "version": "2df5278b0267c799f3e877e8eeddbb6e93cda0bb", "lessThan": "dce6c2aa70e94c04c523b375dfcc664d7a0a560a", "status": "affected", "versionType": "git" }, { "version": "2df5278b0267c799f3e877e8eeddbb6e93cda0bb", "lessThan": "bb37252c9af1cb250f34735ee98f80b46be3cef1", "status": "affected", "versionType": "git" }, { "version": "2df5278b0267c799f3e877e8eeddbb6e93cda0bb", "lessThan": "20080709457bc1e920eb002483d7d981d9b2ac1c", "status": "affected", "versionType": "git" }, { "version": "2df5278b0267c799f3e877e8eeddbb6e93cda0bb", "lessThan": "a67c6397fcb7e842d3c595243049940970541c48", "status": "affected", "versionType": "git" }, { "version": "2df5278b0267c799f3e877e8eeddbb6e93cda0bb", "lessThan": "d77b6ff0ce35a6d0b0b7b9581bc3f76d041d4087", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "net/batman-adv/network-coding.c" ], "versions": [ { "version": "3.10", "status": "affected" }, { "version": "0", "lessThan": "3.10", "status": "unaffected", "versionType": "semver" }, { "version": "5.4.299", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.243", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.192", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.151", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.105", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.46", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.16.6", "lessThanOrEqual": "6.16.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.17", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.10", "versionEndExcluding": "5.4.299" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.10", "versionEndExcluding": "5.10.243" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.10", "versionEndExcluding": "5.15.192" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.10", "versionEndExcluding": "6.1.151" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.10", "versionEndExcluding": "6.6.105" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.10", "versionEndExcluding": "6.12.46" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.10", "versionEndExcluding": "6.16.6" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.10", "versionEndExcluding": "6.17" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/30fc47248f02b8a14a61df469e1da4704be1a19f" }, { "url": "https://git.kernel.org/stable/c/1e36c6c8dc8023b4bbe9a16e819f9998b9b6a183" }, { "url": "https://git.kernel.org/stable/c/5d334bce9fad58cf328d8fa14ea1fff855819863" }, { "url": "https://git.kernel.org/stable/c/dce6c2aa70e94c04c523b375dfcc664d7a0a560a" }, { "url": "https://git.kernel.org/stable/c/bb37252c9af1cb250f34735ee98f80b46be3cef1" }, { "url": "https://git.kernel.org/stable/c/20080709457bc1e920eb002483d7d981d9b2ac1c" }, { "url": "https://git.kernel.org/stable/c/a67c6397fcb7e842d3c595243049940970541c48" }, { "url": "https://git.kernel.org/stable/c/d77b6ff0ce35a6d0b0b7b9581bc3f76d041d4087" } ], "title": "batman-adv: fix OOB read/write in network-coding decode", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "title": "CVE Program Container", "references": [ { "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html" }, { "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html" } ], "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T17:43:54.812Z" } }, { "x_adpType": "supplier", "providerMetadata": { "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "shortName": "siemens-SADP", "dateUpdated": "2026-05-12T12:07:27.513Z" }, "affected": [ { "vendor": "Siemens", "product": "RUGGEDCOM RST2428P", "versions": [ { "status": "affected", "version": "0", "lessThan": "V3.3", "versionType": "custom" } ], "defaultStatus": "unknown" }, { "vendor": "Siemens", "product": "SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family", "versions": [ { "status": "affected", "version": "0", "lessThan": "V3.3", "versionType": "custom" } ], "defaultStatus": "unknown" }, { "vendor": "Siemens", "product": "SCALANCE XCH328", "versions": [ { "status": "affected", "version": "0", "lessThan": "V3.3", "versionType": "custom" } ], "defaultStatus": "unknown" }, { "vendor": "Siemens", "product": "SCALANCE XCM324", "versions": [ { "status": "affected", "version": "0", "lessThan": "V3.3", "versionType": "custom" } ], "defaultStatus": "unknown" }, { "vendor": "Siemens", "product": "SCALANCE XCM328", "versions": [ { "status": "affected", "version": "0", "lessThan": "V3.3", "versionType": "custom" } ], "defaultStatus": "unknown" }, { "vendor": "Siemens", "product": "SCALANCE XCM332", "versions": [ { "status": "affected", "version": "0", "lessThan": "V3.3", "versionType": "custom" } ], "defaultStatus": "unknown" }, { "vendor": "Siemens", "product": "SCALANCE XRH334 (24 V DC, 8xFO, CC)", "versions": [ { "status": "affected", "version": "0", "lessThan": "V3.3", "versionType": "custom" } ], "defaultStatus": "unknown" }, { "vendor": "Siemens", "product": "SCALANCE XRM334 (230 V AC, 12xFO)", "versions": [ { "status": "affected", "version": "0", "lessThan": "V3.3", "versionType": "custom" } ], "defaultStatus": "unknown" }, { "vendor": "Siemens", "product": "SCALANCE XRM334 (230 V AC, 8xFO)", "versions": [ { "status": "affected", "version": "0", "lessThan": "V3.3", "versionType": "custom" } ], "defaultStatus": "unknown" }, { "vendor": "Siemens", "product": "SCALANCE XRM334 (230V AC, 2x10G, 24xSFP, 8xSFP+)", "versions": [ { "status": "affected", "version": "0", "lessThan": "V3.3", "versionType": "custom" } ], "defaultStatus": "unknown" }, { "vendor": "Siemens", "product": "SCALANCE XRM334 (24 V DC, 12xFO)", "versions": [ { "status": "affected", "version": "0", "lessThan": "V3.3", "versionType": "custom" } ], "defaultStatus": "unknown" }, { "vendor": "Siemens", "product": "SCALANCE XRM334 (24 V DC, 8xFO)", "versions": [ { "status": "affected", "version": "0", "lessThan": "V3.3", "versionType": "custom" } ], "defaultStatus": "unknown" }, { "vendor": "Siemens", "product": "SCALANCE XRM334 (24V DC, 2x10G, 24xSFP, 8xSFP+)", "versions": [ { "status": "affected", "version": "0", "lessThan": "V3.3", "versionType": "custom" } ], "defaultStatus": "unknown" }, { "vendor": "Siemens", "product": "SCALANCE XRM334 (2x230 V AC, 12xFO)", "versions": [ { "status": "affected", "version": "0", "lessThan": "V3.3", "versionType": "custom" } ], "defaultStatus": "unknown" }, { "vendor": "Siemens", "product": "SCALANCE XRM334 (2x230 V AC, 8xFO)", "versions": [ { "status": "affected", "version": "0", "lessThan": "V3.3", "versionType": "custom" } ], "defaultStatus": "unknown" }, { "vendor": "Siemens", "product": "SCALANCE XRM334 (2x230V AC, 2x10G, 24xSFP, 8xSFP+)", "versions": [ { "status": "affected", "version": "0", "lessThan": "V3.3", "versionType": "custom" } ], "defaultStatus": "unknown" }, { "vendor": "Siemens", "product": "SIMATIC CN 4100", "versions": [ { "status": "affected", "version": "0", "lessThan": "V5.0", "versionType": "custom" } ], "defaultStatus": "unknown" } ], "references": [ { "url": "https://cert-portal.siemens.com/productcert/html/ssa-089022.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" } ] } ] } }