Riskcovery

CVE-2025-39957

wifi: mac80211: increase scan_ies_len for S1G

State
Published
Severity
7.1 High
Published
Oct 9, 2025
Updated
Oct 15, 2026
Reserved
Apr 16, 2025

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: mac80211: increase scan_ies_len for S1G

Currently the S1G capability element is not taken into account for the scan_ies_len, which leads to a buffer length validation failure in ieee80211_prep_hw_scan() and subsequent WARN in __ieee80211_start_scan(). This prevents hw scanning from functioning. To fix ensure we accommodate for the S1G capability length.

Scores

CVSSScoreVectorSource
3.17.1 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:HLinux

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 0333a81bc83431d7f90391d38aa09e856c5e5b25 to before 93e063f15e17acb8cd6ac90c8f0802c2624e1a74Affected
  • 0333a81bc83431d7f90391d38aa09e856c5e5b25 to before 32adb020b0c32939da1322dcc87fc0ae2bc935d1Affected
  • 0333a81bc83431d7f90391d38aa09e856c5e5b25 to before 0dbad5f5549e54ac269cc04ce89f212892a98cabAffected
  • 0333a81bc83431d7f90391d38aa09e856c5e5b25 to before 7e2f3213e85eba00acb4cfe6d71647892d63c3a1Affected
LinuxLinux
  • 6.4Affected
  • before 6.4Not affected
  • 6.6.108 through 6.6.*Not affected
  • 6.12.49 through 6.12.*Not affected
  • 6.16.9 through 6.16.*Not affected
  • 6.17 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.