CVE-2025-39839: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-39839 is a vulnerability discovered in the Linux kernel's batman-adv component, specifically affecting the network-coding decode functionality. The vulnerability was disclosed on September 19, 2025, and involves an out-of-bounds read/write issue in the network packet decoding process (NVD).

The vulnerability exists in the batadv_nc_skb_decode_packet() function, which incorrectly trusts the coded_len parameter and only validates it against skb->len. The XOR operation starts at sizeof(struct batadv_unicast_packet), which reduces payload headroom, and due to insufficient validation of source skb length, it can lead to out-of-bounds read and write operations (NVD).

The vulnerability can result in out-of-bounds read and write operations in the Linux kernel's batman-adv component, potentially leading to memory corruption and system instability (NVD).

The vulnerability has been addressed in the Linux kernel version 6.12.48-1 for Debian's stable distribution (trixie). System administrators are recommended to upgrade their Linux packages to the patched version (Debian Security).