CVE-2025-39864 Overview
CVE-2025-39864 is a use-after-free vulnerability [CWE-416] in the Linux kernel's cfg80211 wireless configuration subsystem. The flaw resides in the cmp_bss() function path, where cfg80211_update_known_bss() could free beacon frame elements that were still referenced through the hidden_beacon_bss pointer used to track hidden SSID networks. The regression stems from a quirk introduced in commit 776b3580178f ("cfg80211: track hidden SSID networks properly"), which changed beacon element ownership semantics.
Critical Impact
A local attacker with low privileges on a system running vulnerable Linux kernel versions can trigger memory corruption in the wireless stack, potentially leading to kernel memory disclosure, denial of service, or local privilege escalation.
Affected Products
- Linux Kernel (multiple stable branches, including 6.17 release candidates rc1–rc4)
- Debian Linux 11.0
- Siemens industrial products referencing Linux kernel (see SSA-032379 and SSA-089022)
Discovery Timeline
- 2025-09-19 - CVE-2025-39864 published to NVD
- 2026-07-30 - Last updated in NVD database
Technical Details for CVE-2025-39864
Vulnerability Analysis
The vulnerability affects cfg80211, the Linux kernel's 802.11 configuration API that manages Basic Service Set (BSS) entries scanned from wireless networks. The cmp_bss() routine compares BSS entries during scan result processing, dereferencing beacon information elements attached to each entry. When a hidden SSID network is tracked, multiple BSS entries share the same beacon frame elements via the hidden_beacon_bss pointer.
A local attacker with the ability to trigger wireless scan updates can cause cfg80211_update_known_bss() to free beacon frame elements that a sibling BSS still references. Subsequent access from cmp_bss() reads freed memory, producing a use-after-free condition inside kernel context. Exploitation can corrupt adjacent slab objects and pivot toward privilege escalation.
Root Cause
The regression was introduced by commit 776b3580178f. That change added the hidden_beacon_bss pointer so that multiple BSS entries could share a single beacon element buffer. However, cfg80211_update_known_bss() continued to unconditionally free the last beacon frame elements during updates. It did not check whether those elements were still shared through the hidden_beacon_bss linkage. The fix adjusts the free path to release beacon elements only when they are not shared.
Attack Vector
Exploitation requires local access with low privileges on a system with an active or configurable wireless interface. The vulnerability is triggered through the normal scan and BSS update workflow — no user interaction is required beyond the attacker's own actions. Because the corruption occurs in kernel memory and impacts confidentiality, integrity, and availability, a successful exploit can compromise the entire host.
No verified proof-of-concept code has been published. See the upstream fix commits (26e84445, 5b7ae049, 6854476d, 912c4b66, a8bb681e, a97a9791, b7d08929, ff040562) for the corrective logic.
Detection Methods for CVE-2025-39864
Indicators of Compromise
- Kernel oops or KASAN: use-after-free messages referencing cmp_bss or cfg80211_update_known_bss in dmesg or /var/log/kern.log.
- Unexpected wireless stack crashes or WARN_ON traces originating from net/wireless/scan.c.
- Unprivileged processes issuing repeated NL80211_CMD_TRIGGER_SCAN netlink commands or manipulating scan results.
Detection Strategies
- Enable Kernel Address Sanitizer (KASAN) in test environments to surface use-after-free access in the cfg80211 scan path.
- Audit installed kernel packages against the fixed versions listed in the Debian LTS Announcement #00007 and Debian LTS Announcement #00008.
- Monitor for anomalous local process behavior interacting with nl80211 sockets or iw/wpa_supplicant binaries outside their normal operational patterns.
Monitoring Recommendations
- Forward kernel logs to a centralized SIEM and alert on stack traces containing cfg80211, cmp_bss, or hidden_beacon_bss symbols.
- Track kernel version drift across your Linux fleet to identify unpatched hosts.
- Baseline wireless scan frequency per host and alert on unusual bursts that could indicate exploitation attempts.
How to Mitigate CVE-2025-39864
Immediate Actions Required
- Apply the upstream stable kernel updates that include the cfg80211_update_known_bss() fix as soon as vendor packages are available.
- Prioritize patching for laptops, workstations, and edge devices with wireless interfaces enabled, especially multi-user systems.
- For Siemens deployments, consult Siemens Security Advisory SSA-032379 and Siemens Security Advisory SSA-089022 for product-specific guidance.
Patch Information
The Linux kernel maintainers have merged the fix across multiple stable branches. Reference commits include 26e84445, 5b7ae049, 6854476d, 912c4b66, a8bb681e, a97a9791, b7d08929, and ff040562. Debian LTS users should install the kernel packages announced in the October 2025 advisories.
Workarounds
- Disable wireless interfaces on servers or appliances that do not require Wi-Fi connectivity using rfkill block wifi or by unloading the relevant driver modules.
- Restrict local shell access on multi-user hosts to trusted accounts until the patched kernel is deployed.
- Blacklist the cfg80211 module on systems that have no legitimate wireless use case.
# Verify running kernel version and disable wireless if not needed
uname -r
sudo rfkill block wifi
# Optionally prevent cfg80211 from loading on headless servers
echo 'blacklist cfg80211' | sudo tee /etc/modprobe.d/blacklist-cfg80211.conf
sudo update-initramfs -u
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
