{
  "schema_version": "1.6.1",
  "id": "RPI-CVE-2025-39839",
  "modified": "2026-10-09T11:39:44Z",
  "upstream": [
    "CVE-2025-39839"
  ],
  "published": "2025-09-19T15:28:22Z",
  "summary": "batman-adv: fix OOB read/write in network-coding decode",
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nbatman-adv: fix OOB read/write in network-coding decode\n\nbatadv_nc_skb_decode_packet() trusts coded_len and checks only against\nskb->len. XOR starts at sizeof(struct batadv_unicast_packet), reducing\npayload headroom, and the source skb length is not verified, allowing an\nout-of-bounds read and a small out-of-bounds write.\n\nValidate that coded_len fits within the payload area of both destination\nand source sk_buffs before XORing.",
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
    }
  ],
  "affected": [
    {
      "package": {
        "ecosystem": "Raspberry Pi OS:12",
        "name": "linux"
      },
      "versions": [
        "1:6.1.47-1+rpt4"
      ],
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-2712",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v6",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v7",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v7l",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v8",
            "binary_version": "1:6.1.47-1+rpt4"
          }
        ]
      },
      "database_specific": {
        "per_version": {
          "1:6.1.47-1+rpt4": {
            "linux_commit": "655fc658a15ae7a6f37103754adb39ba52a9a14e",
            "upstream_version": "6.1.47",
            "assessment": "commit ancestry (strak rule)",
            "upstream_fixed": "6.1.151",
            "compiled_filter": false
          }
        }
      }
    }
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-39839"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/30fc47248f02b8a14a61df469e1da4704be1a19f"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/1e36c6c8dc8023b4bbe9a16e819f9998b9b6a183"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/5d334bce9fad58cf328d8fa14ea1fff855819863"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/dce6c2aa70e94c04c523b375dfcc664d7a0a560a"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/bb37252c9af1cb250f34735ee98f80b46be3cef1"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/20080709457bc1e920eb002483d7d981d9b2ac1c"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/a67c6397fcb7e842d3c595243049940970541c48"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/d77b6ff0ce35a6d0b0b7b9581bc3f76d041d4087"
    }
  ],
  "database_specific": {
    "source": "https://git.kernel.org/pub/scm/linux/security/vulns.git",
    "upstream_modified": "2026-08-05T12:19:11Z",
    "severity": {
      "source": "kernel CNA",
      "cvss_v3_score": 8.8,
      "cvss_v3_severity": "High",
      "scenario": "AV:A - Coded packets arrive as raw ETH_P_BATMAN layer-2 frames from a direct mesh neighbor over Ethernet or WiFi, handled by batadv_batman_skb_recv() with no IP routing involved. This is the classic same-broadcast-domain / WiFi-mesh injection scenario, i.e. Adjacent.\nAC:L - The attacker controls both halves of the primitive \u2014 the small buffered source frame (routed through the victim so send.c clones it into the decoding hash) and the oversized coded packet carrying coded_len, the MAC-based path key and the CRC packet_id, all computable offline. No race, no memory-layout guessing, and NC-capable nodes self-advertise via the BATADV_TVLV_NC OGM container, so the trigger is deterministic and repeatable.\nPR:N - batman-adv performs no authentication, encryption, or authorization on received frames; any node able to emit frames on the mesh segment reaches batadv_nc_recv_coded_packet(). No credentials, capabilities, or prior mesh membership approval are required.\nUI:N - The victim node processes the injected coded packet automatically in softirq receive context. No action by any user or administrator is needed beyond the mesh already running.\nS:U - The out-of-bounds read and write corrupt kernel heap memory within the kernel's own security authority. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - The missing nc_packet->skb->len check allows reading roughly 1.4 KB of kernel heap past the buffered source skb, and because the data is XORed against attacker-known plaintext and then forwarded to an attacker-chosen orig_dest, the raw heap bytes are recovered remotely. This is a directly weaponizable kernel memory disclosure, not a bounded leak.\nI:H - The XOR overruns the destination skb by up to h_size (10) bytes with attacker-influenced content, landing in skb_shared_info (nr_frags, frag_list, dataref, gso fields) when tailroom is zero. Corrupting those fields drives bogus frag iteration and page puts in skb_release_data(), giving a heap-corruption/UAF primitive exploitable for control-flow hijack.\nA:H - The ~1.4 KB out-of-bounds read readily walks off the slab into unmapped memory, and the skb_shared_info overwrite corrupts refcounts and frag pointers, producing KASAN splats, oopses, or panics. The attacker can repeat this at will with no authentication."
    }
  }
}