CVE-2025-39839

What it actually does

Out-of-bounds read and small out-of-bounds write in batadv_nc_skb_decode_packet due to trusting coded_len with only skb->len check, insufficient payload headroom validation for both destination and source sk_buffs before XOR starting at sizeof(struct batadv_unicast_packet).

Why it matters to the business

Unpatched Linux systems using batman-adv in mesh networks face risk of kernel instability, memory disclosure, or limited corruption; high downstream package exposure via Debian fish on multiple releases increases operational disruption potential despite low exploit likelihood.

How an attack unfolds

Local attacker crafts batman-adv network-coded packets with manipulated coded_len values that pass initial skb->len checks but exceed actual payload areas in source or destination buffers, triggering OOB read during decode and limited write; listed actors such as VMSCAPE have targeted similar Linux kernel issues in container environments.

How to fix it

Upgrade fish package to 2.1.1-1 on Debian 11-14; apply Linux kernel commit 30fc47248f02b8a14a61df469e1da4704be1a19f or later stable equivalent; rebuild and reboot systems using batman-adv.

How to confirm the fix worked

Verify installed kernel and fish package versions against fixed commits; inspect batadv_nc_skb_decode_packet source for added coded_len bounds checks against both skb payload areas; run regression tests exercising network coding decode with boundary-length packets.

Typical attack path

1. Obtain local access on affected Linux system
2. Load or trigger batman-adv network coding path
3. Transmit specially crafted unicast packets with invalid coded_len
4. Cause OOB memory access during batadv_nc_skb_decode_packet XOR operation

How to detect it

Review kernel logs for batman-adv decode errors or oops reports; correlate with unusual packet patterns in network traces involving batadv unicast headers; examine threat actor campaigns targeting similar Linux kernel container issues for related artifacts.

What your security team should do

• Prioritize kernel and fish package updates on all Debian systems within maintenance windows
• Audit environments for batman-adv usage and isolate unpatchable mesh nodes
• Monitor EPSS trend and threat actor activity around related container privilege escalations for escalation signals