Junglewise Threat Intelligence

CVE-2025-39849: Linux Kernel out-of-bounds write in cfg80211 SME SSID handling

CVE-2025-39849 · Severity: high · CVSS 8.8 · Published 2025-09-19

Technologies: Linux Kernel, Siemens SIMATIC CN 4100. Vendors: Linux, Siemens.

Executive brief

A vulnerability exists in the Linux kernel's wireless networking component that could lead to memory corruption when connecting to a Wi-Fi network. If a device connects to a malicious or malformed wireless access point providing an oversized network name (SSID), the system's memory could be compromised. This could result in a complete system crash or allow an attacker within wireless range to gain unauthorized control over the affected device.

Technical details

An out-of-bounds write vulnerability (CWE-787) exists in the Linux kernel's wireless configuration interface (cfg80211) within the Station Management Entity (SME) implementation. The function `__cfg80211_connect_result()` fails to validate that the SSID length provided in a connection result is within the standard `IEEE80211_MAX_SSID_LEN` (32 bytes) before performing a `memcpy` into the `wdev->u.client.ssid` buffer. An attacker within radio range (adjacent network) could broadcast a malformed SSID exceeding 32 bytes to trigger memory corruption. This can lead to a denial of service (kernel panic) or potential arbitrary code execution. The issue has been patched in multiple stable kernel branches including 6.1.151, 6.6.105, 6.12.46, and 6.16.6.

Affected products

  • Linux Linux Kernel 6.1.16 to 6.1.151, 6.2.3 to 6.3, 6.3 and later versions prior to 6.6.105, 6.12.46, 6.16.6
  • Siemens SIMATIC CN 4100 versions prior to V5.0

Timeline

  • 2025-08-29: patched: Initial patch authored by Dan Carpenter
  • 2025-09-19: disclosed: CVE published to NVD

References

Related threats