{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2025-39864", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T07:20:57.143Z", "datePublished": "2025-09-19T15:26:33.787Z", "dateUpdated": "2026-08-05T12:05:44.524Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:05:44.524Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: cfg80211: fix use-after-free in cmp_bss()\n\nFollowing bss_free() quirk introduced in commit 776b3580178f\n(\"cfg80211: track hidden SSID networks properly\"), adjust\ncfg80211_update_known_bss() to free the last beacon frame\nelements only if they're not shared via the corresponding\n'hidden_beacon_bss' pointer." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:A - The trigger is entirely over-the-air 802.11 management traffic — spoofed hidden-SSID beacons/probe responses to populate the victim's BSS cache, plus a CSA element in a beacon or unprotected public action frame — requiring only radio range of the target STA. Per kernel guidance, WiFi frame injection is Adjacent.\nAC:L - The attacker controls every precondition: SSID hiding, BSSID, the two channels, the beacon/probe-response pairs that build the hidden groups, and the CSA that fires `cfg80211_update_assoc_bss_entry()`; the victim's routine background scans supply the rest without attacker effort. The freed object's size is attacker-chosen via IE length, so heap grooming is also under attacker control.\nPR:N - No credentials or account on the target system are needed; beacons, probe responses and public action frames are unauthenticated and unprotected (beacon protection/BIGTK is rarely deployed), so a rogue AP or frame injector reaches the code with zero privileges.\nUI:N - Scanning, beacon processing and CSA handling are performed automatically by the kernel for an associated STA — no user action is required, and the attacker can spoof the legitimate AP's frames against an already-connected victim.\nS:U - The freed `cfg80211_bss_ies` allocation and all corrupted state live in the kernel's own slab and cfg80211 BSS list; no VM, IOMMU or sandbox boundary is crossed.\nC:H - The stale `beacon_ies`/`ies` pointers are read by `cmp_bss()` and, critically, copied wholesale to userspace via `NL80211_BSS_BEACON_IES` in scan dumps, disclosing reallocated freed heap contents — and an attacker-controlled `len` after reallocation extends this to a large out-of-bounds kernel memory read.\nI:H - The shared IEs are freed while still owned by the beacon BSS, so the later `bss_free()` performs a second `kfree_rcu()` on the same object — a double free of an attacker-sized allocation, a well-established primitive for arbitrary write and control-flow hijack; freed-memory contents also drive rb-tree ordering decisions.\nA:H - Use-after-free reads in `cmp_bss()` plus the subsequent double free corrupt the slab allocator and reliably produce oopses/panics, and the condition can be re-triggered at will by an in-range attacker." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "net/wireless/scan.c" ], "versions": [ { "version": "3ab8227d3e7d1d2bf1829675d3197e3cb600e9f6", "lessThan": "a8bb681e879ca3c9f722aa08d3d7ae41c42a8807", "status": "affected", "versionType": "git" }, { "version": "3ab8227d3e7d1d2bf1829675d3197e3cb600e9f6", "lessThan": "a97a9791e455bb0cd5e7a38b5abcb05523d4e21c", "status": "affected", "versionType": "git" }, { "version": "3ab8227d3e7d1d2bf1829675d3197e3cb600e9f6", "lessThan": "ff040562c10a540b8d851f7f4145fa112977f853", "status": "affected", "versionType": "git" }, { "version": "3ab8227d3e7d1d2bf1829675d3197e3cb600e9f6", "lessThan": "6854476d9e1aeaaf05ebc98d610061c2075db07d", "status": "affected", "versionType": "git" }, { "version": "3ab8227d3e7d1d2bf1829675d3197e3cb600e9f6", "lessThan": "b7d08929178c16398278613df07ad65cf63cce9d", "status": "affected", "versionType": "git" }, { "version": "3ab8227d3e7d1d2bf1829675d3197e3cb600e9f6", "lessThan": "5b7ae04969f822283a95c866967e42b4d75e0eef", "status": "affected", "versionType": "git" }, { "version": "3ab8227d3e7d1d2bf1829675d3197e3cb600e9f6", "lessThan": "912c4b66bef713a20775cfbf3b5e9bd71525c716", "status": "affected", "versionType": "git" }, { "version": "3ab8227d3e7d1d2bf1829675d3197e3cb600e9f6", "lessThan": "26e84445f02ce6b2fe5f3e0e28ff7add77f35e08", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "net/wireless/scan.c" ], "versions": [ { "version": "5.4", "status": "affected" }, { "version": "0", "lessThan": "5.4", "status": "unaffected", "versionType": "semver" }, { "version": "5.4.299", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.243", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.192", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.151", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.105", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.46", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.16.6", "lessThanOrEqual": "6.16.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.17", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.4", "versionEndExcluding": "5.4.299" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.4", "versionEndExcluding": "5.10.243" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.4", "versionEndExcluding": "5.15.192" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.4", "versionEndExcluding": "6.1.151" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.4", "versionEndExcluding": "6.6.105" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.4", "versionEndExcluding": "6.12.46" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.4", "versionEndExcluding": "6.16.6" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.4", "versionEndExcluding": "6.17" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/a8bb681e879ca3c9f722aa08d3d7ae41c42a8807" }, { "url": "https://git.kernel.org/stable/c/a97a9791e455bb0cd5e7a38b5abcb05523d4e21c" }, { "url": "https://git.kernel.org/stable/c/ff040562c10a540b8d851f7f4145fa112977f853" }, { "url": "https://git.kernel.org/stable/c/6854476d9e1aeaaf05ebc98d610061c2075db07d" }, { "url": "https://git.kernel.org/stable/c/b7d08929178c16398278613df07ad65cf63cce9d" }, { "url": "https://git.kernel.org/stable/c/5b7ae04969f822283a95c866967e42b4d75e0eef" }, { "url": "https://git.kernel.org/stable/c/912c4b66bef713a20775cfbf3b5e9bd71525c716" }, { "url": "https://git.kernel.org/stable/c/26e84445f02ce6b2fe5f3e0e28ff7add77f35e08" } ], "title": "wifi: cfg80211: fix use-after-free in cmp_bss()", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "title": "CVE Program Container", "references": [ { "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html" }, { "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html" } ], "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T17:44:14.486Z" } }, { "x_adpType": "supplier", "providerMetadata": { "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "shortName": "siemens-SADP", "dateUpdated": "2026-05-12T12:07:43.422Z" }, "affected": [ { "vendor": "Siemens", "product": "RUGGEDCOM RST2428P", "versions": [ { "status": "affected", "version": "0", "lessThan": "V3.3", "versionType": "custom" } ], "defaultStatus": "unknown" }, { "vendor": "Siemens", "product": "SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family", "versions": [ { "status": "affected", "version": "0", "lessThan": "V3.3", "versionType": "custom" } ], "defaultStatus": "unknown" }, { "vendor": "Siemens", "product": "SCALANCE XCH328", "versions": [ { "status": "affected", "version": "0", "lessThan": "V3.3", "versionType": "custom" } ], "defaultStatus": "unknown" }, { "vendor": "Siemens", "product": "SCALANCE XCM324", "versions": [ { "status": "affected", "version": "0", "lessThan": "V3.3", "versionType": "custom" } ], "defaultStatus": "unknown" }, { "vendor": "Siemens", "product": "SCALANCE XCM328", "versions": [ { "status": "affected", "version": "0", "lessThan": "V3.3", "versionType": "custom" } ], "defaultStatus": "unknown" }, { "vendor": "Siemens", "product": "SCALANCE XCM332", "versions": [ { "status": "affected", "version": "0", "lessThan": "V3.3", "versionType": "custom" } ], "defaultStatus": "unknown" }, { "vendor": "Siemens", "product": "SCALANCE XRH334 (24 V DC, 8xFO, CC)", "versions": [ { "status": "affected", "version": "0", "lessThan": "V3.3", "versionType": "custom" } ], "defaultStatus": "unknown" }, { "vendor": "Siemens", "product": "SCALANCE XRM334 (230 V AC, 12xFO)", "versions": [ { "status": "affected", "version": "0", "lessThan": "V3.3", "versionType": "custom" } ], "defaultStatus": "unknown" }, { "vendor": "Siemens", "product": "SCALANCE XRM334 (230 V AC, 8xFO)", "versions": [ { "status": "affected", "version": "0", "lessThan": "V3.3", "versionType": "custom" } ], "defaultStatus": "unknown" }, { "vendor": "Siemens", "product": "SCALANCE XRM334 (230V AC, 2x10G, 24xSFP, 8xSFP+)", "versions": [ { "status": "affected", "version": "0", "lessThan": "V3.3", "versionType": "custom" } ], "defaultStatus": "unknown" }, { "vendor": "Siemens", "product": "SCALANCE XRM334 (24 V DC, 12xFO)", "versions": [ { "status": "affected", "version": "0", "lessThan": "V3.3", "versionType": "custom" } ], "defaultStatus": "unknown" }, { "vendor": "Siemens", "product": "SCALANCE XRM334 (24 V DC, 8xFO)", "versions": [ { "status": "affected", "version": "0", "lessThan": "V3.3", "versionType": "custom" } ], "defaultStatus": "unknown" }, { "vendor": "Siemens", "product": "SCALANCE XRM334 (24V DC, 2x10G, 24xSFP, 8xSFP+)", "versions": [ { "status": "affected", "version": "0", "lessThan": "V3.3", "versionType": "custom" } ], "defaultStatus": "unknown" }, { "vendor": "Siemens", "product": "SCALANCE XRM334 (2x230 V AC, 12xFO)", "versions": [ { "status": "affected", "version": "0", "lessThan": "V3.3", "versionType": "custom" } ], "defaultStatus": "unknown" }, { "vendor": "Siemens", "product": "SCALANCE XRM334 (2x230 V AC, 8xFO)", "versions": [ { "status": "affected", "version": "0", "lessThan": "V3.3", "versionType": "custom" } ], "defaultStatus": "unknown" }, { "vendor": "Siemens", "product": "SCALANCE XRM334 (2x230V AC, 2x10G, 24xSFP, 8xSFP+)", "versions": [ { "status": "affected", "version": "0", "lessThan": "V3.3", "versionType": "custom" } ], "defaultStatus": "unknown" }, { "vendor": "Siemens", "product": "SIMATIC CN 4100", "versions": [ { "status": "affected", "version": "0", "lessThan": "V5.0", "versionType": "custom" } ], "defaultStatus": "unknown" } ], "references": [ { "url": "https://cert-portal.siemens.com/productcert/html/ssa-089022.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" } ] }, { "metrics": [ { "other": { "type": "ssvc", "content": { "id": "CVE-2025-39864", "role": "CISA Coordinator", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "total" } ], "version": "2.0.3", "timestamp": "2026-06-10T20:40:37.439684Z" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-11T18:44:03.638Z" } } ] } }