CVE-2025-39839 (GCVE-0-2025-39839)

Vulnerability from cvelistv5 – Published: 2025-09-19 15:26 – Updated: 2026-08-05 12:05
VLAI
Title
batman-adv: fix OOB read/write in network-coding decode
Summary
In the Linux kernel, the following vulnerability has been resolved: batman-adv: fix OOB read/write in network-coding decode batadv_nc_skb_decode_packet() trusts coded_len and checks only against skb->len. XOR starts at sizeof(struct batadv_unicast_packet), reducing payload headroom, and the source skb length is not verified, allowing an out-of-bounds read and a small out-of-bounds write. Validate that coded_len fits within the payload area of both destination and source sk_buffs before XORing.
Severity
8.8 (High)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 2df5278b0267c799f3e877e8eeddbb6e93cda0bb , < 30fc47248f02b8a14a61df469e1da4704be1a19f (git)
Affected: 2df5278b0267c799f3e877e8eeddbb6e93cda0bb , < 1e36c6c8dc8023b4bbe9a16e819f9998b9b6a183 (git)
Affected: 2df5278b0267c799f3e877e8eeddbb6e93cda0bb , < 5d334bce9fad58cf328d8fa14ea1fff855819863 (git)
Affected: 2df5278b0267c799f3e877e8eeddbb6e93cda0bb , < dce6c2aa70e94c04c523b375dfcc664d7a0a560a (git)
Affected: 2df5278b0267c799f3e877e8eeddbb6e93cda0bb , < bb37252c9af1cb250f34735ee98f80b46be3cef1 (git)
Affected: 2df5278b0267c799f3e877e8eeddbb6e93cda0bb , < 20080709457bc1e920eb002483d7d981d9b2ac1c (git)
Affected: 2df5278b0267c799f3e877e8eeddbb6e93cda0bb , < a67c6397fcb7e842d3c595243049940970541c48 (git)
Affected: 2df5278b0267c799f3e877e8eeddbb6e93cda0bb , < d77b6ff0ce35a6d0b0b7b9581bc3f76d041d4087 (git)
Create a notification for this product.
Linux Linux Affected: 3.10
Unaffected: 0 , < 3.10 (semver)
Unaffected: 5.4.299 , ≤ 5.4.* (semver)
Unaffected: 5.10.243 , ≤ 5.10.* (semver)
Unaffected: 5.15.192 , ≤ 5.15.* (semver)
Unaffected: 6.1.151 , ≤ 6.1.* (semver)
Unaffected: 6.6.105 , ≤ 6.6.* (semver)
Unaffected: 6.12.46 , ≤ 6.12.* (semver)
Unaffected: 6.16.6 , ≤ 6.16.* (semver)
Unaffected: 6.17 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Siemens RUGGEDCOM RST2428P Affected: 0 , < V3.3 (custom)
Create a notification for this product.
Siemens SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family Affected: 0 , < V3.3 (custom)
Create a notification for this product.
Siemens SCALANCE XCH328 Affected: 0 , < V3.3 (custom)
Create a notification for this product.
Siemens SCALANCE XCM324 Affected: 0 , < V3.3 (custom)
Create a notification for this product.
Siemens SCALANCE XCM328 Affected: 0 , < V3.3 (custom)
Create a notification for this product.
Siemens SCALANCE XCM332 Affected: 0 , < V3.3 (custom)
Create a notification for this product.
Siemens SCALANCE XRH334 (24 V DC, 8xFO, CC) Affected: 0 , < V3.3 (custom)
Create a notification for this product.
Siemens SCALANCE XRM334 (230 V AC, 12xFO) Affected: 0 , < V3.3 (custom)
Create a notification for this product.
Siemens SCALANCE XRM334 (230 V AC, 8xFO) Affected: 0 , < V3.3 (custom)
Create a notification for this product.
Siemens SCALANCE XRM334 (230V AC, 2x10G, 24xSFP, 8xSFP+) Affected: 0 , < V3.3 (custom)
Create a notification for this product.
Siemens SCALANCE XRM334 (24 V DC, 12xFO) Affected: 0 , < V3.3 (custom)
Create a notification for this product.
Siemens SCALANCE XRM334 (24 V DC, 8xFO) Affected: 0 , < V3.3 (custom)
Create a notification for this product.
Siemens SCALANCE XRM334 (24V DC, 2x10G, 24xSFP, 8xSFP+) Affected: 0 , < V3.3 (custom)
Create a notification for this product.
Siemens SCALANCE XRM334 (2x230 V AC, 12xFO) Affected: 0 , < V3.3 (custom)
Create a notification for this product.
Siemens SCALANCE XRM334 (2x230 V AC, 8xFO) Affected: 0 , < V3.3 (custom)
Create a notification for this product.
Siemens SCALANCE XRM334 (2x230V AC, 2x10G, 24xSFP, 8xSFP+) Affected: 0 , < V3.3 (custom)
Create a notification for this product.
Siemens SIMATIC CN 4100 Affected: 0 , < V5.0 (custom)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T17:43:54.812Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "RUGGEDCOM RST2428P",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.3",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.3",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XCH328",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.3",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XCM324",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.3",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XCM328",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.3",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XCM332",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.3",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XRH334 (24 V DC, 8xFO, CC)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.3",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XRM334 (230 V AC, 12xFO)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.3",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XRM334 (230 V AC, 8xFO)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.3",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XRM334 (230V AC, 2x10G, 24xSFP, 8xSFP+)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.3",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XRM334 (24 V DC, 12xFO)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.3",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XRM334 (24 V DC, 8xFO)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.3",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XRM334 (24V DC, 2x10G, 24xSFP, 8xSFP+)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.3",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XRM334 (2x230 V AC, 12xFO)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.3",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XRM334 (2x230 V AC, 8xFO)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.3",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XRM334 (2x230V AC, 2x10G, 24xSFP, 8xSFP+)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.3",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC CN 4100",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V5.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-12T12:07:27.513Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-089022.html"
          },
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/batman-adv/network-coding.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "30fc47248f02b8a14a61df469e1da4704be1a19f",
              "status": "affected",
              "version": "2df5278b0267c799f3e877e8eeddbb6e93cda0bb",
              "versionType": "git"
            },
            {
              "lessThan": "1e36c6c8dc8023b4bbe9a16e819f9998b9b6a183",
              "status": "affected",
              "version": "2df5278b0267c799f3e877e8eeddbb6e93cda0bb",
              "versionType": "git"
            },
            {
              "lessThan": "5d334bce9fad58cf328d8fa14ea1fff855819863",
              "status": "affected",
              "version": "2df5278b0267c799f3e877e8eeddbb6e93cda0bb",
              "versionType": "git"
            },
            {
              "lessThan": "dce6c2aa70e94c04c523b375dfcc664d7a0a560a",
              "status": "affected",
              "version": "2df5278b0267c799f3e877e8eeddbb6e93cda0bb",
              "versionType": "git"
            },
            {
              "lessThan": "bb37252c9af1cb250f34735ee98f80b46be3cef1",
              "status": "affected",
              "version": "2df5278b0267c799f3e877e8eeddbb6e93cda0bb",
              "versionType": "git"
            },
            {
              "lessThan": "20080709457bc1e920eb002483d7d981d9b2ac1c",
              "status": "affected",
              "version": "2df5278b0267c799f3e877e8eeddbb6e93cda0bb",
              "versionType": "git"
            },
            {
              "lessThan": "a67c6397fcb7e842d3c595243049940970541c48",
              "status": "affected",
              "version": "2df5278b0267c799f3e877e8eeddbb6e93cda0bb",
              "versionType": "git"
            },
            {
              "lessThan": "d77b6ff0ce35a6d0b0b7b9581bc3f76d041d4087",
              "status": "affected",
              "version": "2df5278b0267c799f3e877e8eeddbb6e93cda0bb",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/batman-adv/network-coding.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.10"
            },
            {
              "lessThan": "3.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.299",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.243",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.192",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.151",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.105",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.46",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.299",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.243",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.192",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.151",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.105",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.46",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.6",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbatman-adv: fix OOB read/write in network-coding decode\n\nbatadv_nc_skb_decode_packet() trusts coded_len and checks only against\nskb-\u003elen. XOR starts at sizeof(struct batadv_unicast_packet), reducing\npayload headroom, and the source skb length is not verified, allowing an\nout-of-bounds read and a small out-of-bounds write.\n\nValidate that coded_len fits within the payload area of both destination\nand source sk_buffs before XORing."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - Coded packets arrive as raw ETH_P_BATMAN layer-2 frames from a direct mesh neighbor over Ethernet or WiFi, handled by batadv_batman_skb_recv() with no IP routing involved. This is the classic same-broadcast-domain / WiFi-mesh injection scenario, i.e. Adjacent.\nAC:L - The attacker controls both halves of the primitive \u2014 the small buffered source frame (routed through the victim so send.c clones it into the decoding hash) and the oversized coded packet carrying coded_len, the MAC-based path key and the CRC packet_id, all computable offline. No race, no memory-layout guessing, and NC-capable nodes self-advertise via the BATADV_TVLV_NC OGM container, so the trigger is deterministic and repeatable.\nPR:N - batman-adv performs no authentication, encryption, or authorization on received frames; any node able to emit frames on the mesh segment reaches batadv_nc_recv_coded_packet(). No credentials, capabilities, or prior mesh membership approval are required.\nUI:N - The victim node processes the injected coded packet automatically in softirq receive context. No action by any user or administrator is needed beyond the mesh already running.\nS:U - The out-of-bounds read and write corrupt kernel heap memory within the kernel\u0027s own security authority. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - The missing nc_packet-\u003eskb-\u003elen check allows reading roughly 1.4 KB of kernel heap past the buffered source skb, and because the data is XORed against attacker-known plaintext and then forwarded to an attacker-chosen orig_dest, the raw heap bytes are recovered remotely. This is a directly weaponizable kernel memory disclosure, not a bounded leak.\nI:H - The XOR overruns the destination skb by up to h_size (10) bytes with attacker-influenced content, landing in skb_shared_info (nr_frags, frag_list, dataref, gso fields) when tailroom is zero. Corrupting those fields drives bogus frag iteration and page puts in skb_release_data(), giving a heap-corruption/UAF primitive exploitable for control-flow hijack.\nA:H - The ~1.4 KB out-of-bounds read readily walks off the slab into unmapped memory, and the skb_shared_info overwrite corrupts refcounts and frag pointers, producing KASAN splats, oopses, or panics. The attacker can repeat this at will with no authentication."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:05:32.570Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/30fc47248f02b8a14a61df469e1da4704be1a19f"
        },
        {
          "url": "https://git.kernel.org/stable/c/1e36c6c8dc8023b4bbe9a16e819f9998b9b6a183"
        },
        {
          "url": "https://git.kernel.org/stable/c/5d334bce9fad58cf328d8fa14ea1fff855819863"
        },
        {
          "url": "https://git.kernel.org/stable/c/dce6c2aa70e94c04c523b375dfcc664d7a0a560a"
        },
        {
          "url": "https://git.kernel.org/stable/c/bb37252c9af1cb250f34735ee98f80b46be3cef1"
        },
        {
          "url": "https://git.kernel.org/stable/c/20080709457bc1e920eb002483d7d981d9b2ac1c"
        },
        {
          "url": "https://git.kernel.org/stable/c/a67c6397fcb7e842d3c595243049940970541c48"
        },
        {
          "url": "https://git.kernel.org/stable/c/d77b6ff0ce35a6d0b0b7b9581bc3f76d041d4087"
        }
      ],
      "title": "batman-adv: fix OOB read/write in network-coding decode",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-39839",
    "datePublished": "2025-09-19T15:26:14.688Z",
    "dateReserved": "2025-04-16T07:20:57.141Z",
    "dateUpdated": "2026-08-05T12:05:32.570Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-39839",
      "date": "2026-08-09",
      "epss": "0.00236",
      "percentile": "0.14609"
    },
    "microsoft_vex": {
      "current_release_date": "2026-02-24T14:41:52.000Z",
      "cve": "CVE-2025-39839",
      "id": "msrc_CVE-2025-39839",
      "initial_release_date": "2025-09-02T00:00:00.000Z",
      "product_status:fixed": "2",
      "product_status:known_affected": "3",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "batman-adv: fix OOB read/write in network-coding decode",
      "url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2025-39839.json",
      "version": "3"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-39839\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-09-19T16:15:42.570\",\"lastModified\":\"2026-07-30T06:23:49.617\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbatman-adv: fix OOB read/write in network-coding decode\\n\\nbatadv_nc_skb_decode_packet() trusts coded_len and checks only against\\nskb-\u003elen. XOR starts at sizeof(struct batadv_unicast_packet), reducing\\npayload headroom, and the source skb length is not verified, allowing an\\nout-of-bounds read and a small out-of-bounds write.\\n\\nValidate that coded_len fits within the payload area of both destination\\nand source sk_buffs before XORing.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/batman-adv/network-coding.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"2df5278b0267c799f3e877e8eeddbb6e93cda0bb\",\"lessThan\":\"30fc47248f02b8a14a61df469e1da4704be1a19f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2df5278b0267c799f3e877e8eeddbb6e93cda0bb\",\"lessThan\":\"1e36c6c8dc8023b4bbe9a16e819f9998b9b6a183\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2df5278b0267c799f3e877e8eeddbb6e93cda0bb\",\"lessThan\":\"5d334bce9fad58cf328d8fa14ea1fff855819863\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2df5278b0267c799f3e877e8eeddbb6e93cda0bb\",\"lessThan\":\"dce6c2aa70e94c04c523b375dfcc664d7a0a560a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2df5278b0267c799f3e877e8eeddbb6e93cda0bb\",\"lessThan\":\"bb37252c9af1cb250f34735ee98f80b46be3cef1\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2df5278b0267c799f3e877e8eeddbb6e93cda0bb\",\"lessThan\":\"20080709457bc1e920eb002483d7d981d9b2ac1c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2df5278b0267c799f3e877e8eeddbb6e93cda0bb\",\"lessThan\":\"a67c6397fcb7e842d3c595243049940970541c48\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2df5278b0267c799f3e877e8eeddbb6e93cda0bb\",\"lessThan\":\"d77b6ff0ce35a6d0b0b7b9581bc3f76d041d4087\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/batman-adv/network-coding.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"3.10\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"3.10\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.4.299\",\"lessThanOrEqual\":\"5.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.243\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.192\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.151\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.105\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.46\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.16.6\",\"lessThanOrEqual\":\"6.16.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.17\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]},{\"source\":\"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\",\"affectedData\":[{\"vendor\":\"Siemens\",\"product\":\"RUGGEDCOM RST2428P\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"V3.3\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"V3.3\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SCALANCE XCH328\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"V3.3\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SCALANCE XCM324\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"V3.3\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SCALANCE XCM328\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"V3.3\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SCALANCE XCM332\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"V3.3\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SCALANCE XRH334 (24 V DC, 8xFO, CC)\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"V3.3\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SCALANCE XRM334 (230 V AC, 12xFO)\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"V3.3\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SCALANCE XRM334 (230 V AC, 8xFO)\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"V3.3\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SCALANCE XRM334 (230V AC, 2x10G, 24xSFP, 8xSFP+)\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"V3.3\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SCALANCE XRM334 (24 V DC, 12xFO)\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"V3.3\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SCALANCE XRM334 (24 V DC, 8xFO)\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"V3.3\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SCALANCE XRM334 (24V DC, 2x10G, 24xSFP, 8xSFP+)\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"V3.3\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SCALANCE XRM334 (2x230 V AC, 12xFO)\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"V3.3\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SCALANCE XRM334 (2x230 V AC, 8xFO)\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"V3.3\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SCALANCE XRM334 (2x230V AC, 2x10G, 24xSFP, 8xSFP+)\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"V3.3\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SIMATIC CN 4100\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"V5.0\",\"versionType\":\"custom\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"ADJACENT_NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H\",\"baseScore\":7.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.2}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-125\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.10\",\"versionEndExcluding\":\"5.4.299\",\"matchCriteriaId\":\"B3742004-7855-4093-AE9A-BB10D77D6CE5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5\",\"versionEndExcluding\":\"5.10.243\",\"matchCriteriaId\":\"6DE4B49A-F1A3-4F0C-96D3-68676CE6BB4C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.192\",\"matchCriteriaId\":\"8A911BD7-361F-45C0-A4A6-33FCBA0F6117\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.151\",\"matchCriteriaId\":\"BC2D0B88-F133-4143-B91D-0A439AA143C0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.105\",\"matchCriteriaId\":\"B9364B0C-6B18-422E-8254-73EF0E856875\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.46\",\"matchCriteriaId\":\"F7E2B332-E920-4CAC-B400-288602DB6F16\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.16.6\",\"matchCriteriaId\":\"548F104C-0F08-438B-9C97-64C903F0C678\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.17:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"327D22EF-390B-454C-BD31-2ED23C998A1C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.17:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"C730CD9A-D969-4A8E-9522-162AAF7C0EE9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.17:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"39982C4B-716E-4B2F-8196-FA301F47807D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.17:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"340BEEA9-D70D-4290-B502-FBB1032353B1\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FA6FEEC2-9F11-4643-8827-749718254FED\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/1e36c6c8dc8023b4bbe9a16e819f9998b9b6a183\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/20080709457bc1e920eb002483d7d981d9b2ac1c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/30fc47248f02b8a14a61df469e1da4704be1a19f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/5d334bce9fad58cf328d8fa14ea1fff855819863\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a67c6397fcb7e842d3c595243049940970541c48\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/bb37252c9af1cb250f34735ee98f80b46be3cef1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d77b6ff0ce35a6d0b0b7b9581bc3f76d041d4087\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/dce6c2aa70e94c04c523b375dfcc664d7a0a560a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://cert-portal.siemens.com/productcert/html/ssa-032379.html\",\"source\":\"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\"},{\"url\":\"https://cert-portal.siemens.com/productcert/html/ssa-089022.html\",\"source\":\"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-06-30T10:15:59+00:00",
      "cve": "CVE-2025-39839",
      "id": "CVE-2025-39839",
      "initial_release_date": "2025-09-19T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: batman-adv: fix OOB read/write in network-coding decode",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-39839.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-25T00:39:45Z",
      "cve": "CVE-2025-39839",
      "id": "CVE-2025-39839",
      "initial_release_date": "2025-09-19T23:24:09Z",
      "product_status:first_fixed": "2",
      "product_status:known_affected": "568",
      "product_status:known_not_affected": "97",
      "product_status:recommended": "500",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-39839",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-39839.json",
      "version": "48"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.