# CVE-2025-39864: Linux Kernel use-after-free in cfg80211 Wi-Fi BSS update

Source: https://junglewise.ai/threats/cve-2025-39864-linux-kernel-use-after-free-in-cfg80211-wi-fi-bss-update  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-09-19. Updated: 2026-07-30  
License: CC BY 4.0 with a link back

CVE-2025-39864 · Severity: high · CVSS 8.8 · Published 2025-09-19

A vulnerability exists in the Linux kernel's Wi-Fi management component (cfg80211) that could allow an attacker to crash the system or potentially execute unauthorized code. The issue occurs when the system incorrectly handles memory for Wi-Fi networks with hidden names (SSIDs). An attacker within Wi-Fi range could exploit this to disrupt network operations or compromise the security of the affected device.

Technologies: [Linux Kernel](https://junglewise.ai/threats/technologies/kernel), [Siemens RUGGEDCOM RST2428P](https://junglewise.ai/threats/technologies/ruggedcom-rst2428p), [Siemens SCALANCE XC-300](https://junglewise.ai/threats/technologies/scalance-xc-300), [Siemens SCALANCE XC-400](https://junglewise.ai/threats/technologies/scalance-xc-400), [Siemens SCALANCE XR-300](https://junglewise.ai/threats/technologies/scalance-xr-300), [Siemens SCALANCE XR-500](https://junglewise.ai/threats/technologies/scalance-xr-500), [Siemens SCALANCE XR-500WG](https://junglewise.ai/threats/technologies/scalance-xr-500wg). Vendors: [Linux](https://junglewise.ai/threats/vendors/linux), [Siemens](https://junglewise.ai/threats/vendors/siemens).

## Quick answers

**Is CVE-2025-39864 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-39864 being exploited in the wild.

**How severe is CVE-2025-39864?** High severity, with a CVSS score of 8.8, published 19 September 2025.

**Which products and versions are affected?** Linux Kernel 5.4 to 5.4.299, 5.5 to 5.10.243, 5.11 to 5.15.192, 5.16 to 6.1.151, 6.2 to 6.6.105, 6.7 to 6.12.46, 6.13 to 6.16.6; Linux Kernel Fixed in 26e8444, 5b7ae04, 6854476, 912c4b6, a8bb681, a97a979, b7d0892, ff04056; Siemens RUGGEDCOM RST2428P < V3.3; Siemens SCALANCE XC-300 < V3.3; and 4 more.

**Is there a fix for CVE-2025-39864?** A patch was published on 2025-08-13: Initial patch authored Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-39864 attacked?** It is attacked from the adjacent network, in an operating system.

**Am I affected by CVE-2025-39864?** Check whether you run Linux Kernel, Linux Kernel, Siemens RUGGEDCOM RST2428P or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A use-after-free (UAF) vulnerability exists in the Linux kernel wifi stack within the `cmp_bss()` and `cfg80211_update_known_bss()` functions in `net/wireless/scan.c`. The root cause is an improper memory management logic where beacon frame elements were being freed even when they were still being shared via the 'hidden_beacon_bss' pointer. This was introduced by a previous refactoring of BSS updates. An attacker within radio range (Adjacent) can trigger this condition by sending specific Wi-Fi management frames, leading to memory corruption. Patches have been released across multiple stable kernel branches to ensure beacon IEs are only freed if they are not shared.

## Affected products

- Linux Linux Kernel Fixed in 26e8444, 5b7ae04, 6854476, 912c4b6, a8bb681, a97a979, b7d0892, ff04056
- Siemens RUGGEDCOM RST2428P < V3.3
- Siemens SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family < V3.3

## Timeline

- 2025-08-13: patched: Initial patch authored
- 2025-09-19: disclosed: CVE published

## References

- [https://git.kernel.org/stable/c/26e84445f02ce6b2fe5f3e0e28ff7add77f35e08](https://git.kernel.org/stable/c/26e84445f02ce6b2fe5f3e0e28ff7add77f35e08)
- [https://git.kernel.org/stable/c/5b7ae04969f822283a95c866967e42b4d75e0eef](https://git.kernel.org/stable/c/5b7ae04969f822283a95c866967e42b4d75e0eef)
- [https://git.kernel.org/stable/c/6854476d9e1aeaaf05ebc98d610061c2075db07d](https://git.kernel.org/stable/c/6854476d9e1aeaaf05ebc98d610061c2075db07d)
- [https://git.kernel.org/stable/c/912c4b66bef713a20775cfbf3b5e9bd71525c716](https://git.kernel.org/stable/c/912c4b66bef713a20775cfbf3b5e9bd71525c716)
- [https://git.kernel.org/stable/c/a8bb681e879ca3c9f722aa08d3d7ae41c42a8807](https://git.kernel.org/stable/c/a8bb681e879ca3c9f722aa08d3d7ae41c42a8807)
- [https://git.kernel.org/stable/c/a97a9791e455bb0cd5e7a38b5abcb05523d4e21c](https://git.kernel.org/stable/c/a97a9791e455bb0cd5e7a38b5abcb05523d4e21c)
- [https://git.kernel.org/stable/c/b7d08929178c16398278613df07ad65cf63cce9d](https://git.kernel.org/stable/c/b7d08929178c16398278613df07ad65cf63cce9d)

## Related threats

- [Linux IOMMU page table logic error in arm_lpae_split_blk_unmap](https://junglewise.ai/threats/cve-2026-56934-in-arm-lpae-split-blk-unmap-of-drivers-iommu-io-pgtable-arm)
- [Linux kernel null pointer dereference in TCP established lookup](https://junglewise.ai/threats/cve-2026-99288-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel xen-netback double unmap memory corruption](https://junglewise.ai/threats/cve-2026-99287-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel xen-netback race condition in XenBus disconnect](https://junglewise.ai/threats/cve-2026-99286-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel shared-frag flag loss in skb_zerocopy](https://junglewise.ai/threats/cve-2026-99284-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)