CVE-2025-39864

wifi: cfg80211: fix use-after-free in cmp_bss()

State: Published
Severity: 8.8 High
Published: Sep 19, 2025
Updated: Aug 5, 2026
Reserved: Apr 16, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: cfg80211: fix use-after-free in cmp_bss()

Following bss_free() quirk introduced in commit 776b3580178f ("cfg80211: track hidden SSID networks properly"), adjust cfg80211_update_known_bss() to free the last beacon frame elements only if they're not shared via the corresponding 'hidden_beacon_bss' pointer.

Scores

CVSS	Score	Vector	Source
3.1	8.8 High	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	3ab8227d3e7d1d2bf1829675d3197e3cb600e9f6 to before a8bb681e879ca3c9f722aa08d3d7ae41c42a8807Affected 3ab8227d3e7d1d2bf1829675d3197e3cb600e9f6 to before a97a9791e455bb0cd5e7a38b5abcb05523d4e21cAffected 3ab8227d3e7d1d2bf1829675d3197e3cb600e9f6 to before ff040562c10a540b8d851f7f4145fa112977f853Affected 3ab8227d3e7d1d2bf1829675d3197e3cb600e9f6 to before 6854476d9e1aeaaf05ebc98d610061c2075db07dAffected 3ab8227d3e7d1d2bf1829675d3197e3cb600e9f6 to before b7d08929178c16398278613df07ad65cf63cce9dAffected 3ab8227d3e7d1d2bf1829675d3197e3cb600e9f6 to before 5b7ae04969f822283a95c866967e42b4d75e0eefAffected 3ab8227d3e7d1d2bf1829675d3197e3cb600e9f6 to before 912c4b66bef713a20775cfbf3b5e9bd71525c716Affected 3ab8227d3e7d1d2bf1829675d3197e3cb600e9f6 to before 26e84445f02ce6b2fe5f3e0e28ff7add77f35e08Affected
LinuxLinux	5.4Affected before 5.4Not affected 5.4.299 through 5.4.Not affected 5.10.243 through 5.10.Not affected 5.15.192 through 5.15.Not affected 6.1.151 through 6.1.Not affected 6.6.105 through 6.6.Not affected 6.12.46 through 6.12.Not affected 6.16.6 through 6.16.*Not affected 6.17 and laterNot affected

Product

Versions

LinuxLinux

3ab8227d3e7d1d2bf1829675d3197e3cb600e9f6 to before a8bb681e879ca3c9f722aa08d3d7ae41c42a8807Affected
3ab8227d3e7d1d2bf1829675d3197e3cb600e9f6 to before a97a9791e455bb0cd5e7a38b5abcb05523d4e21cAffected
3ab8227d3e7d1d2bf1829675d3197e3cb600e9f6 to before ff040562c10a540b8d851f7f4145fa112977f853Affected
3ab8227d3e7d1d2bf1829675d3197e3cb600e9f6 to before 6854476d9e1aeaaf05ebc98d610061c2075db07dAffected
3ab8227d3e7d1d2bf1829675d3197e3cb600e9f6 to before b7d08929178c16398278613df07ad65cf63cce9dAffected
3ab8227d3e7d1d2bf1829675d3197e3cb600e9f6 to before 5b7ae04969f822283a95c866967e42b4d75e0eefAffected
3ab8227d3e7d1d2bf1829675d3197e3cb600e9f6 to before 912c4b66bef713a20775cfbf3b5e9bd71525c716Affected
3ab8227d3e7d1d2bf1829675d3197e3cb600e9f6 to before 26e84445f02ce6b2fe5f3e0e28ff7add77f35e08Affected

LinuxLinux

5.4Affected
before 5.4Not affected
5.4.299 through 5.4.*Not affected
5.10.243 through 5.10.*Not affected
5.15.192 through 5.15.*Not affected
6.1.151 through 6.1.*Not affected
6.6.105 through 6.6.*Not affected
6.12.46 through 6.12.*Not affected
6.16.6 through 6.16.*Not affected
6.17 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.