{"id":"CVE-2025-39957","state":"PUBLISHED","title":"wifi: mac80211: increase scan_ies_len for S1G","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: increase scan_ies_len for S1G\n\nCurrently the S1G capability element is not taken into account\nfor the scan_ies_len, which leads to a buffer length validation\nfailure in ieee80211_prep_hw_scan() and subsequent WARN in\n__ieee80211_start_scan(). This prevents hw scanning from functioning.\nTo fix ensure we accommodate for the S1G capability length.","publishedAt":"2025-10-09T09:47:34.933Z","updatedAt":"2026-10-15T22:02:33.942Z","severity":{"score":7.1,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"0333a81bc83431d7f90391d38aa09e856c5e5b25","status":"affected","lessThan":"93e063f15e17acb8cd6ac90c8f0802c2624e1a74","versionType":"git"},{"version":"0333a81bc83431d7f90391d38aa09e856c5e5b25","status":"affected","lessThan":"32adb020b0c32939da1322dcc87fc0ae2bc935d1","versionType":"git"},{"version":"0333a81bc83431d7f90391d38aa09e856c5e5b25","status":"affected","lessThan":"0dbad5f5549e54ac269cc04ce89f212892a98cab","versionType":"git"},{"version":"0333a81bc83431d7f90391d38aa09e856c5e5b25","status":"affected","lessThan":"7e2f3213e85eba00acb4cfe6d71647892d63c3a1","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/mac80211/main.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.4","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.4","versionType":"semver"},{"version":"6.6.108","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.49","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.16.9","status":"unaffected","lessThanOrEqual":"6.16.*","versionType":"semver"},{"version":"6.17","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/mac80211/main.c"]}],"references":["https://git.kernel.org/stable/c/93e063f15e17acb8cd6ac90c8f0802c2624e1a74","https://git.kernel.org/stable/c/32adb020b0c32939da1322dcc87fc0ae2bc935d1","https://git.kernel.org/stable/c/0dbad5f5549e54ac269cc04ce89f212892a98cab","https://git.kernel.org/stable/c/7e2f3213e85eba00acb4cfe6d71647892d63c3a1"],"weaknesses":[],"ingestedAt":"2026-10-29T20:09:09.358Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/39xxx/CVE-2025-39957.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-39957","state":"PUBLISHED","datePublished":"2025-10-09T09:47:34.933Z","dateUpdated":"2026-10-15T22:02:33.942Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2025-04-16T07:20:57.149Z"},"containers":{"cna":{"title":"wifi: mac80211: increase scan_ies_len for S1G","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: increase scan_ies_len for S1G\n\nCurrently the S1G capability element is not taken into account\nfor the scan_ies_len, which leads to a buffer length validation\nfailure in ieee80211_prep_hw_scan() and subsequent WARN in\n__ieee80211_start_scan(). This prevents hw scanning from functioning.\nTo fix ensure we accommodate for the S1G capability length."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"0333a81bc83431d7f90391d38aa09e856c5e5b25","status":"affected","lessThan":"93e063f15e17acb8cd6ac90c8f0802c2624e1a74","versionType":"git"},{"version":"0333a81bc83431d7f90391d38aa09e856c5e5b25","status":"affected","lessThan":"32adb020b0c32939da1322dcc87fc0ae2bc935d1","versionType":"git"},{"version":"0333a81bc83431d7f90391d38aa09e856c5e5b25","status":"affected","lessThan":"0dbad5f5549e54ac269cc04ce89f212892a98cab","versionType":"git"},{"version":"0333a81bc83431d7f90391d38aa09e856c5e5b25","status":"affected","lessThan":"7e2f3213e85eba00acb4cfe6d71647892d63c3a1","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/mac80211/main.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.4","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.4","versionType":"semver"},{"version":"6.6.108","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.49","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.16.9","status":"unaffected","lessThanOrEqual":"6.16.*","versionType":"semver"},{"version":"6.17","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/mac80211/main.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/93e063f15e17acb8cd6ac90c8f0802c2624e1a74"},{"url":"https://git.kernel.org/stable/c/32adb020b0c32939da1322dcc87fc0ae2bc935d1"},{"url":"https://git.kernel.org/stable/c/0dbad5f5549e54ac269cc04ce89f212892a98cab"},{"url":"https://git.kernel.org/stable/c/7e2f3213e85eba00acb4cfe6d71647892d63c3a1"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","baseScore":7.1,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The failure is reached by initiating a scan on the local host — `nl80211_trigger_scan` over netlink (or an internal mac80211/mlme scan) — not by processing any received frame. No remote or adjacent peer input is involved in triggering the undersized-buffer condition.\nAC:L - The miscalculation is deterministic: on any S1G-capable hardware doing a hardware scan, `ieee80211_build_preq_ies()` always overruns the `scan_ies_len` budget and fails, firing the WARN and passing an uninitialized request to the driver every single time. No race, timing, or memory-layout condition is required.\nPR:L - `NL80211_CMD_TRIGGER_SCAN` is gated by `GENL_UNS_ADMIN_PERM`, i.e. `ns_capable(net->user_ns, CAP_NET_ADMIN)`, which is the user-namespace-aware check and therefore reachable by a low-privileged local user rather than requiring real root; in practice scans are also driven continuously by wpa_supplicant/NetworkManager on behalf of ordinary desktop users.\nUI:N - No victim action is needed — a scan request alone triggers the path, and on affected hardware normal automatic scanning at boot or after connection loss hits it with no user involvement at all.\nS:U - The uninitialized-value use and the WARN both occur within the kernel's own security authority in net/mac80211 and the wireless driver; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - Because `ieee80211_prep_hw_scan()` returns before assigning `req.ie_len`/`req.mac_addr`/`req.mac_addr_mask` yet `__ieee80211_start_scan()` still calls `drv_hw_scan()`, drivers copy `req->ie_len` bytes (uninitialized kmalloc heap value, effectively unbounded) out of the IE buffer into a probe request that is transmitted over the air, disclosing arbitrary adjacent kernel heap memory.\nI:N - All IE emission is bounds-checked via `skb_tailroom()`/`end - pos` guards, so no out-of-bounds write or kernel data modification occurs; the uninitialized length yields only reads.\nA:H - `WARN_ON(!ieee80211_prep_hw_scan())` fires on every scan attempt, which is a kernel panic on the many hardened/embedded builds running `panic_on_warn`, and the subsequent unbounded read driven by the uninitialized `ie_len` can fault or trigger an enormous allocation; hardware scanning is rendered permanently non-functional."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-05T12:06:27.822Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.4","versionEndExcluding":"6.6.108"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.4","versionEndExcluding":"6.12.49"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.4","versionEndExcluding":"6.16.9"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.4","versionEndExcluding":"6.17"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2025-39957","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-15T21:55:06.430509Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-10-15T22:02:33.942Z"}}]}}}