Answer in brief
CVE-2025-39839 records a Unknown severity vulnerability in batman-adv: fix OOB read/write in network-coding decode. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic), Siemens/RUGGEDCOM RST2428P (generic), Siemens/SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family (generic) and additional mapped packages. Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic), Siemens/RUGGEDCOM RST2428P (generic), Siemens/SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family (generic) and additional mapped packages. Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=2df5278b0267c799f3e877e8eeddbb6e93cda0bb <30fc47248f02b8a14a61df469e1da4704be1a19f || >=2df5278b0267c799f3e877e8eeddbb6e93cda0bb <1e36c6c8dc8023b4bbe9a16e819f9998b9b6a183 || >=2df5278b0267c799f3e877e8eeddbb6e93cda0bb <5d334bce9fad58cf328d8fa14ea1fff855819863 || >=2df5278b0267c799f3e877e8eeddbb6e93cda0bb <dce6c2aa70e94c04c523b375dfcc664d7a0a560a || >=2df5278b0267c799f3e877e8eeddbb6e93cda0bb <bb37252c9af1cb250f34735ee98f80b46be3cef1 || >=2df5278b0267c799f3e877e8eeddbb6e93cda0bb <20080709457bc1e920eb002483d7d981d9b2ac1c || >=2df5278b0267c799f3e877e8eeddbb6e93cda0bb <a67c6397fcb7e842d3c595243049940970541c48 || >=2df5278b0267c799f3e877e8eeddbb6e93cda0bb <d77b6ff0ce35a6d0b0b7b9581bc3f76d041d4087 | 30fc47248f02b8a14a61df469e1da4704be1a19f, 1e36c6c8dc8023b4bbe9a16e819f9998b9b6a183, 5d334bce9fad58cf328d8fa14ea1fff855819863, dce6c2aa70e94c04c523b375dfcc664d7a0a560a, bb37252c9af1cb250f34735ee98f80b46be3cef1, 20080709457bc1e920eb002483d7d981d9b2ac1c, a67c6397fcb7e842d3c595243049940970541c48, d77b6ff0ce35a6d0b0b7b9581bc3f76d041d4087 |
| Linux/Linuxgeneric | 3.10 | Not reported |
| Siemens/RUGGEDCOM RST2428Pgeneric | >=0 <V3.3 | V3.3 |
| Siemens/SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 familygeneric | >=0 <V3.3 | V3.3 |
| Siemens/SCALANCE XCH328generic | >=0 <V3.3 | V3.3 |
| Siemens/SCALANCE XCM324generic | >=0 <V3.3 | V3.3 |
| Siemens/SCALANCE XCM328generic | >=0 <V3.3 | V3.3 |
| Siemens/SCALANCE XCM332generic | >=0 <V3.3 | V3.3 |
| Siemens/SCALANCE XRH334 (24 V DC, 8xFO, CC)generic | >=0 <V3.3 | V3.3 |
| Siemens/SCALANCE XRM334 (230 V AC, 12xFO)generic | >=0 <V3.3 | V3.3 |
| Siemens/SCALANCE XRM334 (230V AC, 2x10G, 24xSFP, 8xSFP+)generic | >=0 <V3.3 | V3.3 |
| Siemens/SCALANCE XRM334 (230 V AC, 8xFO)generic | >=0 <V3.3 | V3.3 |
| Siemens/SCALANCE XRM334 (24 V DC, 12xFO)generic | >=0 <V3.3 | V3.3 |
| Siemens/SCALANCE XRM334 (24V DC, 2x10G, 24xSFP, 8xSFP+)generic | >=0 <V3.3 | V3.3 |
| Siemens/SCALANCE XRM334 (24 V DC, 8xFO)generic | >=0 <V3.3 | V3.3 |
| Siemens/SCALANCE XRM334 (2x230 V AC, 12xFO)generic | >=0 <V3.3 | V3.3 |
| Siemens/SCALANCE XRM334 (2x230V AC, 2x10G, 24xSFP, 8xSFP+)generic | >=0 <V3.3 | V3.3 |
| Siemens/SCALANCE XRM334 (2x230 V AC, 8xFO)generic | >=0 <V3.3 | V3.3 |
| Siemens/SIMATIC CN 4100generic | >=0 <V5.0 | V5.0 |
Published upstream
Sep 19, 2025
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 5, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 5, 2026
In the Linux kernel, the following vulnerability has been resolved: batman-adv: fix OOB read/write in network-coding decode batadv_nc_skb_decode_packet() trusts coded_len and checks only against skb->len. XOR starts at sizeof(struct batadv_unicast_packet), reducing payload headroom, and the source skb length is not verified, allowing an out-of-bounds read and a small out-of-bounds write. Validate that coded_len fits within the payload area of both destination and source sk_buffs before XORing.
Quoted source text, attributed separately from HOL analysis.