linux-cve-announce - CVE-2025-39864: wifi: cfg80211: fix use-after-free in cmp

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2025091906-CVE-2025-39864-a3a2@gregkh>
Date: Fri, 19 Sep 2025 17:28:28 +0200
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...nel.org>
Subject: CVE-2025-39864: wifi: cfg80211: fix use-after-free in cmp_bss()

From: Greg Kroah-Hartman <gregkh@...nel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

wifi: cfg80211: fix use-after-free in cmp_bss()

Following bss_free() quirk introduced in commit 776b3580178f
("cfg80211: track hidden SSID networks properly"), adjust
cfg80211_update_known_bss() to free the last beacon frame
elements only if they're not shared via the corresponding
'hidden_beacon_bss' pointer.

The Linux kernel CVE team has assigned CVE-2025-39864 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.4 with commit 3ab8227d3e7d1d2bf1829675d3197e3cb600e9f6 and fixed in 5.4.299 with commit a8bb681e879ca3c9f722aa08d3d7ae41c42a8807
	Issue introduced in 5.4 with commit 3ab8227d3e7d1d2bf1829675d3197e3cb600e9f6 and fixed in 5.10.243 with commit a97a9791e455bb0cd5e7a38b5abcb05523d4e21c
	Issue introduced in 5.4 with commit 3ab8227d3e7d1d2bf1829675d3197e3cb600e9f6 and fixed in 5.15.192 with commit ff040562c10a540b8d851f7f4145fa112977f853
	Issue introduced in 5.4 with commit 3ab8227d3e7d1d2bf1829675d3197e3cb600e9f6 and fixed in 6.1.151 with commit 6854476d9e1aeaaf05ebc98d610061c2075db07d
	Issue introduced in 5.4 with commit 3ab8227d3e7d1d2bf1829675d3197e3cb600e9f6 and fixed in 6.6.105 with commit b7d08929178c16398278613df07ad65cf63cce9d
	Issue introduced in 5.4 with commit 3ab8227d3e7d1d2bf1829675d3197e3cb600e9f6 and fixed in 6.12.46 with commit 5b7ae04969f822283a95c866967e42b4d75e0eef
	Issue introduced in 5.4 with commit 3ab8227d3e7d1d2bf1829675d3197e3cb600e9f6 and fixed in 6.16.6 with commit 912c4b66bef713a20775cfbf3b5e9bd71525c716
	Issue introduced in 5.4 with commit 3ab8227d3e7d1d2bf1829675d3197e3cb600e9f6 and fixed in 6.17-rc5 with commit 26e84445f02ce6b2fe5f3e0e28ff7add77f35e08

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2025-39864
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	net/wireless/scan.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/a8bb681e879ca3c9f722aa08d3d7ae41c42a8807
	https://git.kernel.org/stable/c/a97a9791e455bb0cd5e7a38b5abcb05523d4e21c
	https://git.kernel.org/stable/c/ff040562c10a540b8d851f7f4145fa112977f853
	https://git.kernel.org/stable/c/6854476d9e1aeaaf05ebc98d610061c2075db07d
	https://git.kernel.org/stable/c/b7d08929178c16398278613df07ad65cf63cce9d
	https://git.kernel.org/stable/c/5b7ae04969f822283a95c866967e42b4d75e0eef
	https://git.kernel.org/stable/c/912c4b66bef713a20775cfbf3b5e9bd71525c716
	https://git.kernel.org/stable/c/26e84445f02ce6b2fe5f3e0e28ff7add77f35e08