CVE-2025-39849: Linux Kernel out-of-bounds write in cfg80211 SME SSID handling

CVE-2025-39849 · Severity: high · CVSS 8.8 · Published 2025-09-19

A vulnerability exists in the Linux kernel's wireless networking component that could lead to memory corruption when connecting to a Wi-Fi network. If a device connects to a malicious or malformed wireless access point providing an oversized network name (SSID), the system's memory could be compromised. This could result in a complete system crash or allow an attacker within wireless range to gain unauthorized control over the affected device.

Technologies: Linux Kernel, Siemens SIMATIC CN 4100. Vendors: Linux, Siemens.

Quick answers

Is CVE-2025-39849 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-39849 being exploited in the wild.
How severe is CVE-2025-39849?
High severity, with a CVSS score of 8.8, published 19 September 2025.
Which products and versions are affected?
Linux Kernel 6.1.16 to 6.1.151, 6.2.3 to 6.3, 6.3 and later versions prior to 6.6.105, 6.12.46, 6.16.6, 6.1.16 to 6.1.151, 6.2.3 to 6.6.105, 6.7 to 6.12.46, 6.13 to 6.16.6; Siemens SIMATIC CN 4100 versions prior to V5.0.
Is there a fix for CVE-2025-39849?
A patch was published on 2025-08-29: Initial patch authored by Dan Carpenter Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-39849 attacked?
It is attacked from the adjacent network, in an operating system.
Am I affected by CVE-2025-39849?
Check whether you run Linux Kernel or Siemens SIMATIC CN 4100 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An out-of-bounds write vulnerability (CWE-787) exists in the Linux kernel's wireless configuration interface (cfg80211) within the Station Management Entity (SME) implementation. The function `__cfg80211_connect_result()` fails to validate that the SSID length provided in a connection result is within the standard `IEEE80211_MAX_SSID_LEN` (32 bytes) before performing a `memcpy` into the `wdev->u.client.ssid` buffer. An attacker within radio range (adjacent network) could broadcast a malformed SSID exceeding 32 bytes to trigger memory corruption. This can lead to a denial of service (kernel panic) or potential arbitrary code execution. The issue has been patched in multiple stable kernel branches including 6.1.151, 6.6.105, 6.12.46, and 6.16.6.

Affected products

  • Linux Linux Kernel 6.1.16 to 6.1.151, 6.2.3 to 6.3, 6.3 and later versions prior to 6.6.105, 6.12.46, 6.16.6
  • Siemens SIMATIC CN 4100 versions prior to V5.0

Timeline

  • 2025-08-29: patched: Initial patch authored by Dan Carpenter
  • 2025-09-19: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.