High 8.8Published Sep 19, 2025

CVE-2025-39864wifi: cfg80211: fix use-after-free in cmp_bss()

Updated under an hour ago (Oct 27, 2026, 3:23 AM ET)

Does this affect you?

It affects Linux and 19 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: fix use-after-free in cmp_bss() Following bss_free() quirk introduced in commit 776b3580178f ("cfg80211: track hidden SSID networks properly"), adjust cfg80211_update_known_bss() to free the last beacon frame elements only if they're not shared via the corresponding 'hidden_beacon_bss' pointer.

CVSS: 8.8 HIGH (v3.1, CNA)CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Aug 5, 2026
First seen by InfoSec Signals: Oct 19, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 3ab8227d3e7d1d2bf1829675d3197e3cb600e9f6 before a8bb681e879ca3c9f722aa08d3d7ae41c42a8807; from 3ab8227d3e7d1d2bf1829675d3197e3cb600e9f6 before a97a9791e455bb0cd5e7a38b5abcb05523d4e21c; from 3ab8227d3e7d1d2bf1829675d3197e3cb600e9f6 before ff040562c10a540b8d851f7f4145fa112977f853; from 3ab8227d3e7d1d2bf1829675d3197e3cb600e9f6 before 6854476d9e1aeaaf05ebc98d610061c2075db07d; from 3ab8227d3e7d1d2bf1829675d3197e3cb600e9f6 before b7d08929178c16398278613df07ad65cf63cce9d; from 3ab8227d3e7d1d2bf1829675d3197e3cb600e9f6 before 5b7ae04969f822283a95c866967e42b4d75e0eef; from 3ab8227d3e7d1d2bf1829675d3197e3cb600e9f6 before 912c4b66bef713a20775cfbf3b5e9bd71525c716; from 3ab8227d3e7d1d2bf1829675d3197e3cb600e9f6 before 26e84445f02ce6b2fe5f3e0e28ff7add77f35e08	CNA record
Siemens RUGGEDCOM RST2428P siemens:ruggedcom_rst2428p (from the name)	before V3.3	CISA ADP
Siemens SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family siemens:scalance_xc_300_xr_300_xc_400_xr_500wg_xr_500_family (from the name)	before V3.3	CISA ADP
Siemens SCALANCE XCH328 siemens:scalance_xch328 (from the name)	before V3.3	CISA ADP
Siemens SCALANCE XCM324 siemens:scalance_xcm324 (from the name)	before V3.3	CISA ADP
Siemens SCALANCE XCM328 siemens:scalance_xcm328 (from the name)	before V3.3	CISA ADP
Siemens SCALANCE XCM332 siemens:scalance_xcm332 (from the name)	before V3.3	CISA ADP
Siemens SCALANCE XRH334 (24 V DC, 8xFO, CC) siemens:scalance_xrh334_24_v_dc_8xfo_cc (from the name)	before V3.3	CISA ADP
Siemens SCALANCE XRM334 (230 V AC, 12xFO) siemens:scalance_xrm334_230_v_ac_12xfo (from the name)	before V3.3	CISA ADP
Siemens SCALANCE XRM334 (230 V AC, 8xFO) siemens:scalance_xrm334_230_v_ac_8xfo (from the name)	before V3.3	CISA ADP
1–10 of 20

References

References

https://git.kernel.org/stable/c/a8bb681e879ca3c9f722aa08d3d7ae41c42a8807	patch
https://git.kernel.org/stable/c/a97a9791e455bb0cd5e7a38b5abcb05523d4e21c	patch
https://git.kernel.org/stable/c/ff040562c10a540b8d851f7f4145fa112977f853	patch
https://git.kernel.org/stable/c/6854476d9e1aeaaf05ebc98d610061c2075db07d	patch
https://git.kernel.org/stable/c/b7d08929178c16398278613df07ad65cf63cce9d	patch
https://git.kernel.org/stable/c/5b7ae04969f822283a95c866967e42b4d75e0eef	patch
https://git.kernel.org/stable/c/912c4b66bef713a20775cfbf3b5e9bd71525c716	patch
https://git.kernel.org/stable/c/26e84445f02ce6b2fe5f3e0e28ff7add77f35e08	patch
https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html	mailing-list, third-party-advisory
https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html	mailing-list, third-party-advisory
1–10 of 12

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.