Security readout for executives and security teams
Plain-English summary
A Linux Wi-Fi scanning calculation omitted space for an S1G capability element. The resulting validation failure and kernel warning can prevent hardware-assisted scanning. The supplied CVSS rates potential confidentiality and availability impact highly, but the technical description only confirms scan disruption and does not explain the claimed confidentiality impact.
Executive priority
Prioritize timely remediation for S1G-enabled Linux devices or systems operationally dependent on wireless scanning. Treat broad emergency action as unsupported because active exploitation is not documented and the confirmed behavior is scan failure. Escalate if vendor guidance identifies wider impact or externally reachable attack conditions.
Technical view
In mac80211, scan_ies_len excluded the S1G capability element. During hardware-scan preparation, ieee80211_prep_hw_scan() can therefore reject the calculated buffer length, followed by a warning in __ieee80211_start_scan(). The documented fix accounts for the S1G capability length. The supplied vector is CVSS 3.1 7.1: local, low complexity, low privileges, no user interaction.
Likely exposure
Exposure is most relevant to systems running affected Linux kernel versions that use mac80211 hardware scanning with S1G Wi-Fi capabilities. The supplied affected-version data includes 6.4, 6.6.108, 6.12.49, 6.16.9, and 6.17, but its exact range boundaries are unclear. Confirm status against distribution or kernel-vendor advisories.
Exploitation context
The supplied sources do not establish active exploitation, public exploit availability, or remote reachability. KEV is false. The CVSS vector describes a local attacker requiring low privileges. Evidence confirms a hardware-scan failure path, but does not explain how confidentiality loss would occur.
Researcher notes
The confirmed defect is incorrect information-element length accounting, causing validation failure rather than a documented overwrite. Review the referenced stable commits and downstream backports when mapping versions. The supplied CVSS confidentiality impact is not substantiated by the narrative, so avoid claiming data disclosure without additional evidence.
Mitigation direction
- Identify Linux devices using mac80211 hardware scanning and S1G Wi-Fi capabilities.
- Update to a vendor-supported kernel containing the referenced stable fix.
- Check distribution advisories for precise affected and fixed package versions.
- If updating is delayed, review vendor guidance for safe operational mitigations.
Validation and detection
- Record kernel and distribution package versions on potentially exposed systems.
- Confirm whether wireless hardware and drivers use mac80211 S1G hardware scanning.
- Compare installed packages with vendor-confirmed fixed versions.
- Review kernel logs for scan-related warnings after initiating legitimate wireless scans.
- Verify hardware scanning functions normally after updating.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-39957 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.1 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H1.85.2LinuxVulnerability scoring details
Base CVSS 3.1 score
7.1HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/93e063f15e17acb8cd6ac90c8f0802c2624e1a74CVE reference, Linux
- https://git.kernel.org/stable/c/32adb020b0c32939da1322dcc87fc0ae2bc935d1CVE reference, Linux
- https://git.kernel.org/stable/c/0dbad5f5549e54ac269cc04ce89f212892a98cabCVE reference, Linux
- https://git.kernel.org/stable/c/7e2f3213e85eba00acb4cfe6d71647892d63c3a1CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.