CVE-2025-39864

What it actually does

Use-after-free in cfg80211_update_known_bss() when freeing beacon frame elements that remain referenced via the hidden_beacon_bss pointer after bss_free().

Why it matters to the business

Local attackers can trigger kernel memory corruption on wireless-enabled Linux systems, leading to crashes, data leakage, or privilege escalation; 5 downstream dependents increase exposure across Debian horizon packages and stable kernel trees.

How an attack unfolds

An attacker with local access crafts or manipulates wireless BSS structures to trigger the dangling reference during cmp_bss() comparison, then leverages the resulting UAF for arbitrary read/write in kernel space; observed in campaigns by VMSCAPE and related container privilege-escalation chains.

How to fix it

Upgrade to fixed kernel commit a8bb681e879ca3c9f722aa08d3d7ae41c42a8807 or Debian horizon packages 2014.1.1-3; rebuild and reboot systems with the corrected cfg80211 module.

How to confirm the fix worked

Verify kernel source contains commit a8bb681e879ca3c9f722aa08d3d7ae41c42a8807, confirm cfg80211_update_known_bss() no longer frees shared beacon elements, and test wireless BSS enumeration under hidden-SSID conditions.

Typical attack path

1. Obtain local user access on affected Linux host
2. Trigger wireless BSS update paths that invoke cfg80211_update_known_bss()
3. Force reuse of freed beacon elements via hidden SSID handling
4. Exploit resulting kernel memory corruption for code execution
5. Escalate to root or container escape

How to detect it

Review kernel logs for cfg80211-related use-after-free warnings or panics around BSS update paths; correlate with wireless interface activity and hidden SSID probe responses.

What your security team should do

• Prioritize patching kernel and horizon packages within 30 days given publication age and related threat-actor activity
• Restrict local wireless configuration privileges until patched
• Monitor for kernel oops or panic events tied to cfg80211
• Apply compensating controls such as disabling unnecessary Wi-Fi interfaces