Security readout for executives and security teams
Plain-English summary
A flaw in Linux's batman-adv network-coding feature can make the kernel read or overwrite memory beyond valid packet buffers. A nearby network attacker may be able to compromise data or crash an exposed system without credentials or user interaction.
Executive priority
Treat this as a high-priority, exposure-dependent kernel issue. Promptly identify systems using batman-adv network coding and update exposed deployments. Emergency organization-wide action is not supported without confirming feature usage, and the supplied sources do not substantiate active exploitation.
Technical view
batadv_nc_skb_decode_packet() validated coded_len against the destination skb's total length, although XOR processing begins after the batadv_unicast_packet header. It also failed to validate the source skb length. This permits an out-of-bounds read and a small out-of-bounds write. Stable fixes validate both payload areas before XOR processing.
Likely exposure
Exposure is most likely on affected Linux systems where batman-adv network coding is enabled and reachable by an adjacent network participant. Systems not using this feature are less likely to expose the vulnerable path. The supplied version data is insufficient for reliable distribution-specific build mapping.
Exploitation context
The bundle marks this CVE as absent from KEV and provides no evidence of active exploitation or public weaponization. This does not prove exploitation has not occurred. Its CVSS vector indicates adjacent-network access, low complexity, no required privileges, and no user interaction.
Researcher notes
The vulnerable boundary calculation confuses total skb length with usable payload length and omits equivalent validation for the source skb. The correction checks coded_len against both payload regions. The mechanism and fix are well documented, but the bundle's version list is ambiguous; distribution and appliance builds require vendor confirmation.
Mitigation direction
- Apply a vendor-supported kernel update containing the applicable CVE-2025-39839 stable fix.
- Consult Linux, distribution, or device-vendor guidance for exact fixed packages and reboot requirements.
- Prioritize systems using batman-adv network coding on broadly accessible adjacent networks.
- If updates are unavailable, request a vendor-supported mitigation rather than assuming feature changes are safe.
Validation and detection
- Record the running kernel release and package build on potentially affected systems.
- Confirm whether batman-adv is present, enabled, and configured for network coding.
- Map each kernel build to an applicable stable fix commit or vendor advisory.
- After updating, verify the fixed kernel is running and the vendor marks the CVE resolved.
- Review kernel telemetry for crashes or memory-corruption symptoms; their absence does not disprove compromise.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-39839 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H2.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
8.8HighVector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/30fc47248f02b8a14a61df469e1da4704be1a19fCVE reference, Linux
- https://git.kernel.org/stable/c/1e36c6c8dc8023b4bbe9a16e819f9998b9b6a183CVE reference, Linux
- https://git.kernel.org/stable/c/5d334bce9fad58cf328d8fa14ea1fff855819863CVE reference, Linux
- https://git.kernel.org/stable/c/dce6c2aa70e94c04c523b375dfcc664d7a0a560aCVE reference, Linux
- https://git.kernel.org/stable/c/bb37252c9af1cb250f34735ee98f80b46be3cef1CVE reference, Linux
- https://git.kernel.org/stable/c/20080709457bc1e920eb002483d7d981d9b2ac1cCVE reference, Linux
- https://git.kernel.org/stable/c/a67c6397fcb7e842d3c595243049940970541c48CVE reference, Linux
- https://git.kernel.org/stable/c/d77b6ff0ce35a6d0b0b7b9581bc3f76d041d4087CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/10/msg00008.htmlCVE reference, CVE
- https://lists.debian.org/debian-lts-announce/2025/10/msg00007.htmlCVE reference, CVE
- https://cert-portal.siemens.com/productcert/html/ssa-089022.htmlCVE reference, siemens-SADP
- https://cert-portal.siemens.com/productcert/html/ssa-032379.htmlCVE reference, siemens-SADP
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.