CVE-2025-39849CWE-787

CVE-2025-39849

High · published September 19, 2025

CVSS v3.1
8.8
EPSS
0%
Percentile
12.1
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result()

If the ssid->datalen is more than IEEE80211_MAX_SSID_LEN (32) it would

lead to memory corruption so add some bounds checking.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00222 · 12.1th percentile
Weakness
CWE-787 · Out-of-bounds Write
Published
2025-09-19T20:15Z
Affected products (9)
ProductVersionsFixed in
linux/linux_kernel≥ 6.1.16, < 6.1.1516.1.151
linux/linux_kernel≥ 6.2.3, < 6.6.1056.6.105
linux/linux_kernel≥ 6.7, < 6.12.466.12.46
linux/linux_kernel≥ 6.13, < 6.16.66.16.6
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
debian/debian_linuxall versions—
References (7)
https://git.kernel.org/stable/c/31229145e6ba5ace3e9391113376fa05b7831ede · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/5cb7cab7adf9b1e6a99e2081b0e30e9e59d07523 · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/62b635dcd69c4fde7ce1de4992d71420a37e51e3 · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/8e751d46336205abc259ed3990e850a9843fb649 · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/e472f59d02c82b511bc43a3f96d62ed08bf4537f · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html · af854a3a-2127-422b-91ae-364da2661108https://cert-portal.siemens.com/productcert/html/ssa-032379.html · 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
EPSS history
Timeline
  • 19 SEP 15:26Z
    wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result()
    cvelistv5