CVE-2025-39864

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-39864
In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: fix use-after-free in cmp_bss() Following bss_free() quirk introduced in commit 776b3580178f ("cfg80211: track hidden SSID networks properly"), adjust cfg80211_update_known_bss() to free the last beacon frame elements only if they're not shared via the corresponding 'hidden_beacon_bss' pointer.

7.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/26e84445f02ce6b2fe5f3e0e28ff7add77f35e08 Patch
https://git.kernel.org/stable/c/5b7ae04969f822283a95c866967e42b4d75e0eef Patch
https://git.kernel.org/stable/c/6854476d9e1aeaaf05ebc98d610061c2075db07d Patch
https://git.kernel.org/stable/c/912c4b66bef713a20775cfbf3b5e9bd71525c716 Patch
https://git.kernel.org/stable/c/a8bb681e879ca3c9f722aa08d3d7ae41c42a8807 Patch
https://git.kernel.org/stable/c/a97a9791e455bb0cd5e7a38b5abcb05523d4e21c Patch
https://git.kernel.org/stable/c/b7d08929178c16398278613df07ad65cf63cce9d Patch
https://git.kernel.org/stable/c/ff040562c10a540b8d851f7f4145fa112977f853 Patch
https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html Third Party Advisory Mailing List
https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html Third Party Advisory Mailing List
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.17:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.17:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.17:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.17:rc4:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
History

20 Jan 2026, 20:41

Type Values Removed Values Added
CPE cpe:2.3:o:linux:linux_kernel:6.17:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.17:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.17:rc3:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.17:rc1:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.8
CWE CWE-416
References () https://git.kernel.org/stable/c/26e84445f02ce6b2fe5f3e0e28ff7add77f35e08 - () https://git.kernel.org/stable/c/26e84445f02ce6b2fe5f3e0e28ff7add77f35e08 - Patch
References () https://git.kernel.org/stable/c/5b7ae04969f822283a95c866967e42b4d75e0eef - () https://git.kernel.org/stable/c/5b7ae04969f822283a95c866967e42b4d75e0eef - Patch
References () https://git.kernel.org/stable/c/6854476d9e1aeaaf05ebc98d610061c2075db07d - () https://git.kernel.org/stable/c/6854476d9e1aeaaf05ebc98d610061c2075db07d - Patch
References () https://git.kernel.org/stable/c/912c4b66bef713a20775cfbf3b5e9bd71525c716 - () https://git.kernel.org/stable/c/912c4b66bef713a20775cfbf3b5e9bd71525c716 - Patch
References () https://git.kernel.org/stable/c/a8bb681e879ca3c9f722aa08d3d7ae41c42a8807 - () https://git.kernel.org/stable/c/a8bb681e879ca3c9f722aa08d3d7ae41c42a8807 - Patch
References () https://git.kernel.org/stable/c/a97a9791e455bb0cd5e7a38b5abcb05523d4e21c - () https://git.kernel.org/stable/c/a97a9791e455bb0cd5e7a38b5abcb05523d4e21c - Patch
References () https://git.kernel.org/stable/c/b7d08929178c16398278613df07ad65cf63cce9d - () https://git.kernel.org/stable/c/b7d08929178c16398278613df07ad65cf63cce9d - Patch
References () https://git.kernel.org/stable/c/ff040562c10a540b8d851f7f4145fa112977f853 - () https://git.kernel.org/stable/c/ff040562c10a540b8d851f7f4145fa112977f853 - Patch
References () https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html - () https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html - Third Party Advisory, Mailing List
References () https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html - () https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html - Third Party Advisory, Mailing List
First Time Linux
Debian
Debian debian Linux
Linux linux Kernel

03 Nov 2025, 18:16

Type Values Removed Values Added
References
  • () https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html -
  • () https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html -

19 Sep 2025, 16:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-09-19 16:15

Updated : 2026-01-20 20:41

NVD link : CVE-2025-39864

Mitre link : CVE-2025-39864

CVE.ORG link : CVE-2025-39864

JSON object : View

Products Affected

debian

  • debian_linux

linux

  • linux_kernel
CWE
CWE-416

Use After Free