CVE-2025-39864: Linux Kernel use-after-free in cfg80211 Wi-Fi BSS update

CVE-2025-39864 · Severity: high · CVSS 8.8 · Published 2025-09-19

A vulnerability exists in the Linux kernel's Wi-Fi management component (cfg80211) that could allow an attacker to crash the system or potentially execute unauthorized code. The issue occurs when the system incorrectly handles memory for Wi-Fi networks with hidden names (SSIDs). An attacker within Wi-Fi range could exploit this to disrupt network operations or compromise the security of the affected device.

Technologies: Linux Kernel, Siemens RUGGEDCOM RST2428P, Siemens SCALANCE XC-300, Siemens SCALANCE XC-400, Siemens SCALANCE XR-300, Siemens SCALANCE XR-500, Siemens SCALANCE XR-500WG. Vendors: Linux, Siemens.

Quick answers

Is CVE-2025-39864 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-39864 being exploited in the wild.
How severe is CVE-2025-39864?
High severity, with a CVSS score of 8.8, published 19 September 2025.
Which products and versions are affected?
Linux Kernel 5.4 to 5.4.299, 5.5 to 5.10.243, 5.11 to 5.15.192, 5.16 to 6.1.151, 6.2 to 6.6.105, 6.7 to 6.12.46, 6.13 to 6.16.6; Linux Kernel Fixed in 26e8444, 5b7ae04, 6854476, 912c4b6, a8bb681, a97a979, b7d0892, ff04056; Siemens RUGGEDCOM RST2428P < V3.3; Siemens SCALANCE XC-300 < V3.3; and 4 more.
Is there a fix for CVE-2025-39864?
A patch was published on 2025-08-13: Initial patch authored Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-39864 attacked?
It is attacked from the adjacent network, in an operating system.
Am I affected by CVE-2025-39864?
Check whether you run Linux Kernel, Linux Kernel, Siemens RUGGEDCOM RST2428P or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A use-after-free (UAF) vulnerability exists in the Linux kernel wifi stack within the `cmp_bss()` and `cfg80211_update_known_bss()` functions in `net/wireless/scan.c`. The root cause is an improper memory management logic where beacon frame elements were being freed even when they were still being shared via the 'hidden_beacon_bss' pointer. This was introduced by a previous refactoring of BSS updates. An attacker within radio range (Adjacent) can trigger this condition by sending specific Wi-Fi management frames, leading to memory corruption. Patches have been released across multiple stable kernel branches to ensure beacon IEs are only freed if they are not shared.

Affected products

  • Linux Linux Kernel Fixed in 26e8444, 5b7ae04, 6854476, 912c4b6, a8bb681, a97a979, b7d0892, ff04056
  • Siemens RUGGEDCOM RST2428P < V3.3
  • Siemens SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family < V3.3

Timeline

  • 2025-08-13: patched: Initial patch authored
  • 2025-09-19: disclosed: CVE published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.