Answer in brief
CVE-2025-39864 records a Unknown severity vulnerability in wifi: cfg80211: fix use-after-free in cmp_bss(). The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic), Siemens/RUGGEDCOM RST2428P (generic), Siemens/SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family (generic) and additional mapped packages. Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic), Siemens/RUGGEDCOM RST2428P (generic), Siemens/SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family (generic) and additional mapped packages. Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=3ab8227d3e7d1d2bf1829675d3197e3cb600e9f6 <a8bb681e879ca3c9f722aa08d3d7ae41c42a8807 || >=3ab8227d3e7d1d2bf1829675d3197e3cb600e9f6 <a97a9791e455bb0cd5e7a38b5abcb05523d4e21c || >=3ab8227d3e7d1d2bf1829675d3197e3cb600e9f6 <ff040562c10a540b8d851f7f4145fa112977f853 || >=3ab8227d3e7d1d2bf1829675d3197e3cb600e9f6 <6854476d9e1aeaaf05ebc98d610061c2075db07d || >=3ab8227d3e7d1d2bf1829675d3197e3cb600e9f6 <b7d08929178c16398278613df07ad65cf63cce9d || >=3ab8227d3e7d1d2bf1829675d3197e3cb600e9f6 <5b7ae04969f822283a95c866967e42b4d75e0eef || >=3ab8227d3e7d1d2bf1829675d3197e3cb600e9f6 <912c4b66bef713a20775cfbf3b5e9bd71525c716 || >=3ab8227d3e7d1d2bf1829675d3197e3cb600e9f6 <26e84445f02ce6b2fe5f3e0e28ff7add77f35e08 | a8bb681e879ca3c9f722aa08d3d7ae41c42a8807, a97a9791e455bb0cd5e7a38b5abcb05523d4e21c, ff040562c10a540b8d851f7f4145fa112977f853, 6854476d9e1aeaaf05ebc98d610061c2075db07d, b7d08929178c16398278613df07ad65cf63cce9d, 5b7ae04969f822283a95c866967e42b4d75e0eef, 912c4b66bef713a20775cfbf3b5e9bd71525c716, 26e84445f02ce6b2fe5f3e0e28ff7add77f35e08 |
| Linux/Linuxgeneric | 5.4 | Not reported |
| Siemens/RUGGEDCOM RST2428Pgeneric | >=0 <V3.3 | V3.3 |
| Siemens/SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 familygeneric | >=0 <V3.3 | V3.3 |
| Siemens/SCALANCE XCH328generic | >=0 <V3.3 | V3.3 |
| Siemens/SCALANCE XCM324generic | >=0 <V3.3 | V3.3 |
| Siemens/SCALANCE XCM328generic | >=0 <V3.3 | V3.3 |
| Siemens/SCALANCE XCM332generic | >=0 <V3.3 | V3.3 |
| Siemens/SCALANCE XRH334 (24 V DC, 8xFO, CC)generic | >=0 <V3.3 | V3.3 |
| Siemens/SCALANCE XRM334 (230 V AC, 12xFO)generic | >=0 <V3.3 | V3.3 |
| Siemens/SCALANCE XRM334 (230V AC, 2x10G, 24xSFP, 8xSFP+)generic | >=0 <V3.3 | V3.3 |
| Siemens/SCALANCE XRM334 (230 V AC, 8xFO)generic | >=0 <V3.3 | V3.3 |
| Siemens/SCALANCE XRM334 (24 V DC, 12xFO)generic | >=0 <V3.3 | V3.3 |
| Siemens/SCALANCE XRM334 (24V DC, 2x10G, 24xSFP, 8xSFP+)generic | >=0 <V3.3 | V3.3 |
| Siemens/SCALANCE XRM334 (24 V DC, 8xFO)generic | >=0 <V3.3 | V3.3 |
| Siemens/SCALANCE XRM334 (2x230 V AC, 12xFO)generic | >=0 <V3.3 | V3.3 |
| Siemens/SCALANCE XRM334 (2x230V AC, 2x10G, 24xSFP, 8xSFP+)generic | >=0 <V3.3 | V3.3 |
| Siemens/SCALANCE XRM334 (2x230 V AC, 8xFO)generic | >=0 <V3.3 | V3.3 |
| Siemens/SIMATIC CN 4100generic | >=0 <V5.0 | V5.0 |
Published upstream
Sep 19, 2025
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 5, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 5, 2026
In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: fix use-after-free in cmp_bss() Following bss_free() quirk introduced in commit 776b3580178f ("cfg80211: track hidden SSID networks properly"), adjust cfg80211_update_known_bss() to free the last beacon frame elements only if they're not shared via the corresponding 'hidden_beacon_bss' pointer.
Quoted source text, attributed separately from HOL analysis.